6 posts tagged with "detections"

A detection release for Microsoft Entra ID, published November 10, 2026. One new high-severity rule, EntraID_MFA_Downgrade, alerts when a user who signs in with a passkey, a security key or a certificate completes a sign-in with a password and a weaker MFA method instead, from a network they have never used the stronger method from. That is the step an adversary-in-the-middle phishing page needs, and the one that let the attacker in during the Workday payroll session hijack described in the advisory. The rule also alerts on a password and weaker MFA from a browser that claims to be Safari on Windows.

No action is needed: the rule syncs to every instance automatically.

A detection release for password sprays against Microsoft 365, published October 30 and 31, 2026. Two new high-severity rules alert when a sign-in presents the user's correct password from a password-spray client, or when Smart Lockout refuses a correct password from a network the user never signs in from. Both work without Microsoft Entra ID P2. Two existing rules are sharpened. Together they answer the low-and-slow spray Fluency has seen in 42 of 104 monitored Microsoft 365 tenants since October 1, 2026, described in the advisory.

No action is needed: the rules sync to every instance automatically.

A detection release for password-spray account takeover in Microsoft 365, published October 23, 2026. A new high-severity behavior rule, EntraID_SignIn_After_Block, alerts when an attacker who holds a user's password gets into the account after Conditional Access blocked their earlier attempts. It catches the Azure CLI password spraying that Huntress has reported since June 2026, when a risk policy stops the sprayer once and they come back from another address. A precision fix to EntraID_Valid_Password_Blocked ships with it.

No action is needed: the rules sync to every instance automatically.

A detection release for Microsoft Entra ID, published October 23, 2026. Four new behavior rules alert when an app (a service principal acting with no user signed in) assigns directory roles or adds credentials to other apps. An attacker does exactly this with a stolen app certificate or secret, as in the Storm-0940 compromise of ConnectWise's multi-tenant apps that Microsoft reported on October 21. Until now, role assignments and credential changes made by an app were only context, or one step of the EntraID_App_Takeover correlation.

No action is needed: the rules sync to every instance automatically. These notes also correct how the October 18–20 notes described EntraID_DeviceCode_UserApp.

A detection release for the help desk impersonation campaign that Microsoft Threat Intelligence reported on September 2, 2026, published October 23, 2026. The attacker poses as IT support or a colleague in a Teams chat, calls seconds later, and walks the user into a remote-support session or an installer. Two new high-confidence behavior rules cover the first two steps. O365_Teams_OnMicrosoft_Tenant_Chat alerts on the chat, when it comes from a throwaway *.onmicrosoft.com tenant. O365_Endpoint_Download_From_Azure_CloudApp alerts when a browser downloads an installer from the kind of throwaway Azure host these crews use to deliver it.

No action is needed: the rules sync to every instance automatically.

A detection release for Microsoft Entra ID and Microsoft 365, rolled out October 18–20, 2026. It adds 19 alerting behavior rules and 12 context rules covering three campaigns reported by Microsoft Threat Intelligence (Storm-2755's adversary-in-the-middle (AiTM) session theft, Storm-2372's device-code phishing, and Storm-3119's takeover of whole tenants through a registered app) plus detections for persistence, privilege and sign-in abuse. Five older rules are retired or removed.

No action is needed: the rules sync to every instance automatically.