Microsoft Graph Request User Impersonation by Unusual Client

Description

This New Terms rule focuses on the first occurrence of a client application ID (azure.graphactivitylogs.properties.app_id) making a request to Microsoft Graph API for a specific tenant ID (azure.tenant_id) and user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id). This rule may helps identify unauthorized access or actions performed by compromised accounts. Advesaries may succesfully compromise a user's credentials and use the Microsoft Graph API to access resources or perform actions on behalf of the user.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.
Log source category: event_index

Known benign triggers

Administrative or automated tasks that involve accessing Microsoft Graph API using the specified client application ID and tenant ID, such as provisioning or managing resources.
Authorized third-party applications or services that use the specified client application ID to access Microsoft Graph API resources for legitimate purposes.
Users legitimately accessing Microsoft Graph API using the specified client application ID and tenant ID. This may include authorized applications or services that interact with Microsoft Graph on behalf of users.

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
pushsecurity.com/blog/consentfix	Unclassified	8
www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/	Threat report	19

Detection rules

Microsoft Graph Request User Impersonation by Unusual Client

Description

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules