Daily Defender News
Aboutmerill.net
Microsoft Defender for Identity
Identity protection

Alerts Xdr

14 October 2026Doc update+48 / −21 lines

In brief

The alert catalog now includes updated descriptions and fields, plus entries for several OAuth, Okta, Kerberos, AD CS, and DPAPI-related alerts. The malicious MFA device registration severity is shown as High.

What Defender admins need to know

Administrators have more current alert names, descriptions, severity information, and investigation context to use when reviewing Defender for Identity alerts.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Security alert name Severity MITRE Technique Detector ID
A compromised user account signed in
Description:Credential stuffing led to a successful sign in, confirming an account has been compromised and accessed by an unauthorized party.		HighT1078xdr_CredentialStuffingToolObserved
AADInternals private key extraction attempt
Description:AADInternals was used to decrypt a certificate's private key as an administrator. A successfully decrypted private key might be used to impersonate hybrid components such as Pass-through Authentication (PTA) and Microsoft Entra Cloud Sync, which might lead to lateral movement to the cloud.		 High T1552.004 xdr_AADInternalsPrivateKeyExtractAttempt
A compromised user account signed inAnomalous OAuth device code authentication activity
Description:Credential stuffing ledAn OAuth device code authentication was detected in a context that deviates from the user’s typical behavior and sign-in patterns. Device code flow is generally associated with command-line tools, IoT devices, or non-browser-based applications. This anomalous activity may indicate a potential device code phishing attack and requires immediate investigation due to a successful sign in, confirming an account has been compromised and accessed by anthe risk of unauthorized party.token issuance or post-authentication token abuse.		 HighMedium T1078T1528, T1078.004 xdr_CredentialStuffingToolObservedxdr_AnomalousDeviceCodeAuthV2
Anomalous OAuth device code authentication activity
Description:An OAuth device code authentication was detected in a context that deviates from the user’s typical behavior and sign-in patterns. Device code flow is generally associated with command-line tools, IoT devices, or non-browser-based applications. This anomalous activity may indicate a potential device code phishing attack and requires immediate investigation due to the risk of unauthorized token issuance or post-authentication token abuse.		MediumT1528, T1078.004xdr_AnomalousDeviceCodeAuthV3
Anomalous token exchange following device code authentication
Description:An OAuth Device Code authentication was detected in an unusual context based on user behavior and sign-in patterns. Due to the design of Device Code flows, this activity requires immediate investigation as it may indicate unauthorized token issuance or post-authentication abuse.		 High T1528, T1078.004 xdr_AnomalousDeviceCodeAuth
Anomalous volume of failed Okta authentication attempts
Description:An anomalous burst of failed Okta authentication attempts was observed for one user account from a single source IP address. The failure volume significantly exceeded the user's normal rate. This activity might indicate a brute-force or credential-stuffing attack. A subsequent successful authentication from the same source or with related attributes might indicate account compromise.		MediumT1110xdr_OktaBruteForceAnomaly
AS-REP roasting
Description:Multiple attempts to sign in without preauthentication were detected. This behavior might indicate an Authentication Server Response (AS-REP) roasting attack, which targets the Kerberos authentication protocol, specifically accounts that have turned off preauthentication.		 High T1558.004 xdr_AsrepRoastingAttack
DCSync attack (replication of directory services)
Description:A DCSync replication request was detected from {IPAddress}{SourceIpAddress} by {SourceAccountName}. This indicates an attacker may be using Directory Replication Service (DRS) to extract password hashes from Active Directory, potentially compromising all domain credentials.		 High T1003.006 xdr_DcSyncAttackDetected
Kerberos authentication following AD CS compromise
Description:A user account signed in using Kerberos with a malicious certificate. An attacker might have compromised Active Directory Certificate Services (AD CS) to issue certificates to arbitrary users, possibly including privileged accounts such as administrators.		HighT1078.002, T1649xdr_DisruptMaliciousCertificate
Kerberos privilege escalation using a diamond ticket
Description:A Kerberos service ticket (TGS) was obtained using a suspicious ticket-granting ticket (TGT). The TGT may have been modified to grant unauthorized privileges, consistent with a diamond ticket attack.		HighT1558, T1558.001xdr_DiamondTicketAttack
Malicious registration of an attacker controlled MFA device
Description:A new malicious Microsoft Authenticator device was registered to the account, enabling persistent attacker access through an attacker controlled MFA method.		 MediumHigh T1556.006, T1098.005 xdr_MFAMethodAdditionxdr_MFADeviceRegistrationByKnownTA
Malicious request of Data Protection API (DPAPI) master key
Description:A request for a Data Protection API (DPAPI) master key was detected from {IPAddress}, by account {SourceAccountName}. This activity can indicate credential access, where an attacker attempts to obtain material that can decrypt protected credentials and secrets.		HighT1003xdr_MaliciousRequestOfDataProtectionAPIMasterKey
Malicious sign in from a randomized user agent
Description:A user's credentials were intercepted from an unusual user agent. This user agent has recently been observed in a sign-in pattern related to adversary-in-the-middle and password spraying attacks. We recommend that you promptly investigate this alert, as an attacker might already be using the stolen credentials to move laterally in the network.		 High T1539, T1110.003, T1110.001 xdr_AnomalousRandomUASignIn
Multiple failed Okta authentication attempts detected
Description:Multiple failed Okta authentication attempts were detected for user {AccountUpn}. A total of {TotalFailedRequestCounts} failed attempts originated from IP address {IPAddress} within a 2 minute window. The attempts involved authentication actions {ActionType}. This activity indicates a brute force attack or credential stuffing attempt. The user agent string {UserAgent} was used across all attempts.		 High T1110 xdr_OktaMultipleFailedLogons
Multiple failed Okta sign in attempts followed by successful sign in with anomalous user behavior
Description:Multiple failed sign-in attempts followed by a successful sign-in were observed for user {AccountUpn} within a short time span. The activity included high-risk properties {RiskyBehaviors}, classified by Okta as {RiskLevel}. All sign-in attempts originated from a single IP address {IPAddress}.		 High T1110, T1078 xdr_OktaMultipleFailedLogonsFollowedBySignIn
NEGOEX relay attack
Description:An attacker used NEGOEX to impersonate a server that a client wants to connect to so that the attacker can then relay the authentication process to any target. This allows the attacker to gain access to the target. NEGOEX is an authentication protocol designed to authenticate user accounts to Microsoft Entra joined devices.		 High T1187, T1557.001 xdr_NegoexRelayAttack
Okta access or refresh token grant from a risky context
Description:An Okta OAuth access or refresh token was successfully granted in a context flagged by Okta's threat or risk indicators. This activity might indicate unauthorized token issuance, which could allow an attacker to maintain access without reentering credentials.		MediumT1528xdr_OktaTokenGrantsFromRiskyContext
Okta FastPass phishing attack detected
Description:A successful Okta FastPass phishing attack was detected for user {AccountUpn}. An initial phishing attempt was declined at {phishingAttemptTime}, but the compromised session {SessionId} was later used for authentication actions at {Timestamp}. The session originated from IP address {PhishingIPAddress} and was subsequently reused from {ReuseIPAddress} with user agent {ReuseUserAgent}. Risk level: {SessionReuseRisk}.		 High T1539, T1550.004 xdr_OktaFastPassPhishingAttempt
Okta privileged role assigned to application
Description:{ActorAliasName} assigned {RoleDisplayName} role to application: {ApplicationDisplayName}		 High T1003.006T1098.003 xdr_OktaPrivilegedRoleAssignedToApplication
Possible account secret leak
Description:A failed attempt to sign in to a user account by a credential stuffing tool was detected. The error code indicates that the secret was valid but misused. The user account's credentials might have been leaked or are in the possession of an unauthorized party.		 High T1078 xdr_CredentialStuffingToolObserved
Possible adversary-in-the-middle (AiTM) attack detected (ConsentFix)
Description:A possible token theft has been detected. Threat actor tricked a user into granting consent or sharing an authorization code through social engineering or adversary-in-the-middle (AiTM) techniques. A stolen code is exchanged for access tokens. Threat actor then impersonates the user without a password or multifactor authentication (MFA). This allows unauthorized access to Microsoft 365 services and sensitive data.		 High T1557 xdr_PossibleAitMConsentFix
Possible AS-REP roasting attack
Description:A suspicious Kerberos authentication request was made to accounts that do not require pre-authentication. An attacker might be performing an AS-REP roasting attack to steal passwords and gain further access into the network.		 Medium T1558.004 xdr_AsrepRoastingAttack
Possibly compromised service principal account signed in
Description:A possibly compromised service principal account signed in. An automated tool used for discovery successfully logged into a service principal account, indicating that the service principal account's credentials might have been leaked or are in the possession of an unauthorized party.		 High T1078 xdr_DiscoveryToolObserved
Possibly compromised user account signed in
Description:A possibly compromised user account signed in. An automated tool used for discovery successfully logged into a user account, indicating that the user account's credentials might have been leaked or are in the possession of an unauthorized party.		 High T1078 xdr_DiscoveryToolObserved
SailPoint ISC suspected brute-force attack
Description:Multiple failed authentication attempts were detected in SailPoint Identity Security Cloud from the IP address {IPAddress}. This activity might indicate a potential brute-force attack.		 High T1110.001 xdr_SailPointBruteforceAttack
Stolen session cookie replay detected
Description:An active user session was observed across different environments with inconsistent user-agent, network, or location attributes. This anomaly may indicate unauthorized session reuse and should be investigated for potential account compromise.		HighT1557, T1539, T1598xdr_DisruptBrowserSessionCookieTheft
Suspected brute-force attack (Kerberos, NTLM)
Description:Suspicious brute force has been detected. A threat actor might have carried out brute force on your Active Directory and possibly found passwords of users, could lead to serious security threats and data breach.		 Medium T1110.001 xdr_OnPremBruteforce
Suspected brute-force attack on Lightweight Directory Access Protocol (LDAP) authentication
Description:A series of suspicious login attempts from a single device was detected against a single user account.		 Medium T1110.001 xdr_LdapBindBruteforce
Suspected Conditional Access bypass via non-compliant device
Description:A sign-in was observed from non‑compliant devices where Conditional Access policies requiring device compliance were not enforced for the accessed resources. The previously compliant devices are no longer compliant, which might indicate post‑compromise changes. This pattern might be indicative of adversarial activity where an attacker degrades device compliance while continuing to sign in to targeted resources through Conditional Access bypass paths, enabling token issuance or further access. Go through the Recommendation section to immediately investigate and mitigate associated risks.		 Medium T1078.004 xdr_SuspectedCABwithNonCompliantDevice
Suspected password spray attack (Kerberos, NTLM)
Description:Suspicious password spray has been detected. A threat actor might have carried out password spray on your Active Directory and possibly found passwords of users, could lead to serious security threats and data breach.		 Medium T1110.003 xdr_OnPremPasswordSpray
Suspected password spray attack on Lightweight Directory Access Protocol (LDAP) authentication
Description:A single device was observed attempting logins across multiple user accounts, indicating a malicious authentication pattern.		 Medium T1110.003 xdr_LdapBindBruteforce
Suspected PetitPotam coercion attack
Description:An Encrypting File System Remote Protocol (EFSRPC) request from {SourceIpAddress} coerced a targeted device to authenticate to an attacker-controlled host. This technique, known as PetitPotam, captures the machine account's NTLM authentication, which attackers can relay to other services to impersonate the machine and escalate toward domain compromise. For related background, see https://security.microsoft.com/intel-explorer/cves/CVE-2021-36942.		HighT1187xdr_SuspectedPetitPotamCoercion
Suspicious Active Directory Certificate Services (AD CS) machine certificate issuance abuse (ESC8)
Description:A certificate request was detected for a machine account that may be inconsistent with expected enrollment behavior. This may indicate an ESC8 Active Directory Certificate Services (AD CS) abuse scenario, in which an attacker obtains a machine certificate on behalf of a victim system, potentially via NTLM relay to a vulnerable enrollment endpoint. Such a certificate can be used for authentication (e.g., Kerberos PKINIT), allowing the attacker to impersonate the machine account and gain unauthorized access to domain resources. Go through the Recommendation section to immediately investigate and mitigate associated risks.		HighT1649, T1550.003xdr_SuspiciousAdcsEsc8MachineCertificateIssuanceAbuse
Suspicious Active Directory Certificate Services (AD CS) machine certificate issuance over RPC (ESC11)
Description:A certificate request was detected for a machine account that may be inconsistent with expected enrollment behavior. This may indicate an ESC11 Active Directory Certificate Services (AD CS) abuse scenario, in which an attacker obtains a machine certificate on behalf of a victim system, potentially via NTLM relay to the AD CS RPC interface. Such a certificate can be used for authentication (e.g., Kerberos PKINIT), allowing the attacker to impersonate the machine account and gain unauthorized access to domain resources. Go through the Recommendation section to immediately investigate and mitigate associated risks.		HighT1649, T1550.003xdr_SuspiciousAdcsEsc11MachineCertificateIssuanceAbuse
Suspicious Certificate Authority (CA) certificate and private key theft
Description:A suspicious export of an Active Directory Certificate Services (AD CS) certificate authority certificate and private key was detected. Access to the CA private key may allow an attacker to forge authentication certificates, impersonate privileged identities, and maintain persistent access.		HighT1649xdr_CertificateAuthorityCertificateAndPrivateKeyTheft
Suspicious creation of ESXi group
Description:A suspicious VMWare ESXi group was created in the domain. This might indicate that an attacker is trying to get more permissions for later steps in an attack.		 High T1098 xdr_SuspiciousUserAdditionToEsxGroup
Suspicious DMSA related activity detected
Description:A suspicious Delegated Managed Service Account (DMSA) related activity was detected. This may indicate a compromised managed account or an attempt to exploit a DMSA account.		 High T1555 xdr_SuspiciousDmsaAction
Suspicious email app consent grant
Description:A suspicious email application consent grant has been detected from a possibly compromised user account. An attacker might have leveraged the illicit consent grant to use the legitimate email application for unauthorized access to and collection of user data, persistence, or to maliciously send email on behalf of the user.		 Medium T1110.004, T1110.003 xdr_MfaTamperingAndEmailSoftwareAbuse
Suspicious Kerberos authentication (AS-REQ)
Description:A suspicious Kerberos authentication request (AS-REQ) for a ticket-granting ticket (TGT) was observed. This anomalous TGT request is suspected to have been specially crafted by an attacker. The attacker might be using stolen credentials to leverage this attack.		 Medium T1550, T1558 xdr_SusKerberosAuth_AsReq
Suspicious Kerberos authentication (TGS-REQ)
Description:A suspicious Kerberos ticket-granting service (TGS) ticket request has been observed. This anomalous TGS request is suspected to have been specially crafted by an attacker, possibly using a malicious tool. The attacker might also be using stolen credentials to carry out this attack. Anomalous Kerberos TGS requests are commonly observed in various attack techniques, including Kerberoasting, remote code execution (RCE), credential dumping, among others.		 Medium T1550, T1558 xdr_SusKerberosAuth_TgsReq
Suspicious Kerberos authentication (TGT request using TGS-REQ)
Description:A suspicious Kerberos ticket-granting service request (TGS-REQ) involving the Service for User to Self (S4U2self) extension was observed. This anomalous TGS request is suspected to have been specially crafted by an attacker. S4U2self is an extension that allows a service to obtain a Kerberos service ticket on behalf of another user, for itself. Successful authentication using this extension-when targeting the krbtgt service-can result in valid TGTs being issued on behalf of the targeted user.		 Medium T1550, T1558 xdr_SusKerberosAuth_S4U2selfTgsReq
Suspicious Kerberos PKINIT authentication (AS-REQ)
Description:A suspicious Kerberos Public Key Cryptography for Initial Authentication (PKINIT) request for a ticket-granting ticket (TGT) was observed. This activity may indicate that an unauthorized certificate is being used to authenticate as the affected account.		MediumT1649, T1558xdr_SusKerberosPkinitAuth_AsReq
Suspicious Kerberos ticket authorization data
Description:A Kerberos service ticket request contained anomalous authorization data in the presented ticket. This might indicate that a Kerberos ticket was forged or modified to impersonate an account or obtain unauthorized privileges, as in golden or diamond ticket attacks.		HighT1558, T1558.001xdr_AnomalousKerberosTicket
Suspicious login attempt using possibly compromised account certificate
Description:A suspicious login attempt using a possibly compromised account certificate has been observed. Previous attempts most likely have already occurred to steal or add the certificate to the service principal so the threat actor could use it in the future. The threat actor might have compromised the Entra service account certificate and used it for service principal account sign-in. If not mitigated, a compromised service principal account sign-in on an Entra service could lead to privilege escalation, account takeover, credential exposure, and unauthorized access to proprietary data and files.		 High T1649 xdr_SuspiciousLoginWithExchange
Suspicious network connection over Encrypting File System Remote Protocol
Description:A suspicious Encrypting File System Remote Protocol (EFSRPC) connection was observed from {SourceIpAddress}. This activity is associated with PetitPotam (CVE-2021-36942), where an attacker makes EFSRPC calls to a domain controller in an attempt to coerce NTLM authentication. If successfully exploited, it could allow credential theft and lateral movement. For more information about the vulnerability, see https://security.microsoft.com/intel-explorer/cves/CVE-2021-36942.		MediumT1187xdr_SuspiciousConnectionOverEFSRPC
Suspicious NTLM authentication
Description:One or more suspicious NTLM authentication attempts originating from the IP address {SourceIpAddress} have been detected. This anomalous NTLM authentication activity is suspected to have been specially crafted by an attacker, possibly as part of an attack involving a malicious tool. The attacker might also be using stolen credentials to carry out this attack. Anomalous NTLM behavior is commonly observed in various attack techniques, including pass-the-hash, reconnaissance, brute-force, remote code execution (RCE), and others.		 Medium T1550.002, T1087.002 xdr_SuspiciousNtlmAuthentication
Suspicious on-premisesprem account enablement after disruption
Description:An account that was previously disabled as part of a disruption or containment action was subsequently re‑enabled. This behavior is highly suspicious and may indicate an attempt by a threat actor to restore access to a compromised identity or bypass containment measures.		 High T1098 xdr_SuspiciousAccountEnabled
Suspicious OS switch sign-in
Description:An unexpected change in operating system is observed during a user sign‑in while the client profile remains consistent. Such shifts are uncommon for stable environments. This might indicate token replay, session hijacking, or authentication artifact reuse from a different platform. A potential identity compromise might be in progress through anomalous changes in the user’s device context. Go through the Recommended Action section to immediately investigate and mitigate associated risks.		 Medium T1078 xdr_SuspiciousOsSwitchSignIn
Suspicious registration of a new Authenticator MFA method
Description:A new Microsoft Authenticator device was registered for a user account that Microsoft Defender classified as very high risk. This activity might indicate that an attacker who compromised the account registered their own device to maintain persistent MFA access, allowing continued authentication even after a password reset.		 Medium T1556.006, T1098.005 xdr_MFAMethodAddition
Suspicious registration of a new Email MFA method
Description:An email MFA method was added or changed for a user account that Microsoft Defender classified as very high risk. This activity might indicate that an attacker who compromised the account added their own email address as an MFA method to maintain persistent access and enable self-service password reset abuse.		 Medium T1556.006, T1098.005 xdr_MFAMethodAddition
Suspicious registration of a new Phone MFA method
Description:A phone MFA method was added or changed for a user account that Microsoft Defender classified as very high risk. This might indicate that an attacker who compromised the account registered their own phone number as an MFA method to maintain persistent access and bypass future MFA challenges. Unauthorized MFA changes on a high-risk account can enable long-term account takeover.		 Medium T1556.006, T1098.005 xdr_MFAMethodAddition
Suspicious SAM Account Name Change
Description:Detected a suspicious change of the SAM account name, which may indicate an attempt to exploit Kerberos authentication via NTP time manipulation (Timeroasting). This technique can allow attackers to brute-force or replay Kerberos tickets, leading to credential compromise and lateral movement.		 Medium T1110.001, T1558.003 xdr_SuspiciousChangeOfSamName
Suspicious sign in with CSRF speedbump trigger
Description:Microsoft Entra ID detected a successful risky sign-in following CSRF (cross-site request forgery) speedbump trigger alert. This typically occurs when the sign-in flow deviates from expected browser behavior, such as session or cookie inconsistencies, missing or invalid forged tokens, or rapid automated request patterns.		 Medium T1557, T1185 xdr_CsrfSpeedbumpToRiskyLogin
Suspicious sign-in via Temporary Access Pass
Description:This detection identifies a suspicious sign-in using a Temporary Access Pass (TAP) where the admin who created the TAP had suspicious sign-in activity prior to TAP creation. This pattern may indicate an attacker compromised a privileged admin, created a TAP for a target user, and used it to gain access while bypassing MFA. Prompt investigation is recommended.		MediumT1078.004, T1550xdr_AnomalousSignInViaTemporarayAccessPass
User exhibiting spike in distinct application‑application-resource access combinations
Description:A user account was observed interacting with an unusually high number of distinct cloud application‑resource combinations within a short time period and running uncommon cloud application actions. The observed activity corresponds to sign‑ins flagged as risky where multifactor authentication (MFA) was satisfied using a stored credential, and where the account password hasn't been updated recently. An increase in the diversity of accessed application‑resource combinations under these authentication conditions might reflect abnormal cloud service interaction patterns and should be reviewed.		 Medium T1087 xdr_SpikeAppResourceInSignIns
User identity risk elevated based on defender risk assessment
Description:Microsoft Defender detected increased identity risk for this user through correlated behavioral analysis and alert signals. The observed activity may indicate account compromise and should be investigated.		HighT1110.003, T1110.004, T1528, T1539xdr_DisruptDefenderHighUserRisk
User sign‑in from shared client infrastructure exhibiting anomalous activity
Description:A suspicious shared client infrastructure activity has been observed. The suspicious sign‑in activity came from a client infrastructure with an unusual spike in distinct users and accessed resources. Repeated multifactor authentication (MFA) failures were followed by a successful MFA sign‑in, suggesting persistent authentication attempts from shared or automated infrastructure and potential account compromise. Go through the Recommended Action section to immediately investigate and mitigate associated risks.		 Medium T1078 xdr_SuspiciousSharedClientInfraActivity

Defense Evasion alerts

| Attempt to disable Defender for Identity service principal observed
Description:An actor attempted to disable or impair the security application responsible for generating identity and authentication alerts. This behavior is consistent with adversaries seeking to evade detection after initial access, maintain persistence, or disrupt monitoring by modifying, stopping, or uninstalling security services. Such activity often occurs following credential compromise, privilege escalation, or lateral movement. | High | T1562.001 | xdr_SuspectedMDITampering | | Skipped MFA on remembered device from uncommon ISP sign-in
Description:A suspicious Microsoft Entra sign-in from an internet service provider (ISP) the account hasn't used in the past 30 days skipped multi-factor authentication (MFA) on a remembered device. This indicates that an attacker might have used a stolen persistent cookie replayed from the attacker's infrastructure instead of the user's normal network. It's important to investigate and mitigate this urgently because skipped MFA could lead to potential security risks such as unauthorized access, session hijacking, and data breach. | Medium | T1550.004, T1078.004 | xdr_SuspiciousMfaSkip | | Suspicious access denial to view primary group ID of an object
Description:An access control list (ACL) denied access to view the primary group ID of an object. An attacker might have compromised a user account and is looking to hide the group of a backdoor user. | Medium | T1564.002 | xdr_SuspiciousDenyAccessToPrimaryGroupId | | Suspicious account link
Description:An account was linked through a cross tenant administrative action. The action was performed in a suspicious way that may indicate the account may be used in an attempt to bypass MFA. | Medium | T1556 | xdr_SuspiciousAccountLink | | Suspicious property lock deactivated on Microsoft Entra application
Description:The servicePrincipalLockConfiguration.isEnabled property of a Microsoft Entra application or one of its associated service principals was modified. Disabling this lock removes essential built-in protections that guard against unauthorized credential rotation, redirect URI tampering, and illicit permission grants. Changes to this setting are rare during standard administrative operations and often signal suspicious activity. Threat actors can deliberately disable the lock to weaken the application's security posture, creating an opening for lateral movement or privilege escalation within the environment. | Medium | T1562.001, T1671 | xdr_SuspiciousPropertyLockEntra |

Discovery alerts

Security alert name Severity MITRE Technique Detector ID
Newly created user performed organization branding change
Description:A newly created user account performed an organization branding change shortly after account creation. This behavior may indicate malicious use of attacker-controlled accounts with elevated privileges to perform tenant defacement or unauthorized configuration changes.		HighT1491.001, T1136.003, T1098.003xdr_SuspiciousBrandingChangesByNewUser
Suspicious bulk user deletion via scripted activity
Description:A high volume of user deletion operations was detected from a single account within a short time window using a Python-based user agent. This behavior is consistent with an attacker using automated scripting to mass-delete user accounts after gaining administrative access, potentially causing widespread disruption to organizational identity infrastructure. Attackers may leverage stolen credentials or compromised service principals to delete users in bulk, disrupting business operations and removing evidence of previously compromised accounts.		 Medium T1531 xdr_SuspiciousBulkUserDeletion
Newly created user performed organization branding change
Description:A newly created user account performed an organization branding change shortly after account creation. This behavior may indicate malicious use of attacker-controlled accounts with elevated privileges to perform tenant defacement or unauthorized configuration changes.		HighT1491.001, T1136.003, T1098.003xdr_SuspiciousBrandingChangesByNewUser

Initial Access alerts

Security alert name Severity MITRE Technique Detector ID
Account compromised following a password-spray attack
Description:A user was signed in from an unusual location and browser during a password spray attack. An attacker might have compromised the user account for unauthorized access to the network. We recommend prompt investigation to mitigate potential security risks.		MediumT1078.004, T1110.003xdr_PasswordSprayToSuccessfulLogon
Failed credential abuse attempt in Entra ID authentication
Description:A failed authentication attempt was detected that aligns with patterns commonly associated with credential abuse or identity attacks. This activity may indicate an attempt to use advanced attack techniques targeting identity infrastructure.		 Low T1078.004 xdr_SuspiciousEntraFailedAuthentication
Malicious ADFS authentication
Description:A domain-joined account signed in using Active Directory Federation Services (ADFS) from a malicious IP address. An attacker might have stolen a user's credentials and is using it to move laterally in the organization.		HighT1078xdr_DisruptMaliciousIp
Okta anomalous privileged account authentication
Description:An anomalous authentication was detected for the privileged Okta account {ActorAliasName}. This activity might indicate unauthorized access to an administrative account, which might enable changes to users, applications, or identity settings. Legitimate changes in location, device, network, or sign-in behavior can also produce anomalous authentication signals.		MediumT1078.004xdr_OktaAnomalousAdminAuthentication
Okta anonymous user access
Description:Anonymous User access was detected.		 High T1078 xdr_OktaAnonymousUserAccess
Password spray against OneLogin
Description:A suspicious IP address attempted to authenticate to OneLogin using multiple valid accounts. An attacker might be attempting to find valid user account credentials for later follow-on behavior.		MediumT1110.003xdr_OneLoginPasswordSpray
Potential credential abuse in Entra ID authentication
Description:A successful authentication attempt was detected that aligns with patterns commonly associated with credential abuse or identity attacks. This activity may indicate an attempt to use advanced attack techniques targeting identity infrastructure.		 High T1078.004 xdr_SuspiciousEntraAuthentication
Suspicious account sign-in and configuration changes
Description:Suspicious sign-in and configuration changes have been observed from this account. This behavior might indicate that the user account was compromised and is being used for malicious activities.		 Low T1078.001 xdr_SuspiciousSignInAndUserTampering
Suspicious Entra Connect account authentication
Description:A suspicious authentication by an Entra Connect account originating from the IP address {SourceIpAddress} was detected. This authentication is anomalous because it does not match typical Entra Connect activity and is therefore suspected to originate from a non-Entra Connect server. This might indicate that the Entra Connect account has been compromised and is being used by an attacker to leverage its permissions for attacks such as DCSync.		 High T1078, T1556.007 xdr_SuspiciousEntraConnectAccountAuthentication
Suspicious Entra cookie request from suspicious IP address
Description:A successful sign-in originating from a threat intelligence (TI)-associated IP address attempted to request a Primary Refresh Token (PRT) cookie in Microsoft Entra. This activity may indicate an attacker-controlled host attempting to abuse PRT authentication.		MediumT1078.001xdr_SuspiciousEntraSignIn
Suspicious Entra P2P certificate request from suspicious IP address
Description:A successful sign-in originating from a threat intelligence (TI)-associated IP address attempted to request a peer-to-peer (P2P) certificate in Microsoft Entra. This activity may indicate an attacker-controlled host attempting to abuse certificate-based authentication.		 Medium T1078.001 xdr_SuspiciousEntraSignIn
Suspicious Graph API request made from Entra ID sync application
Description:An unexpected Graph API request made by Entra ID synchronization service application was detected. This behavior might indicate that the application was compromised and is being used for malicious activities. Go through the recommended actions to investigate immediately and mitigate associated risks.		 Medium T1087, T1069 xdr_SuspiciousConnectSyncProvisioningGraphAPIActivity
Suspicious Okta account enumeration
Description:A suspicious IP address enumerated Okta accounts. An attacker might be attempting to perform discovery activities for later follow-on behavior.		 High T1078.004 xdr_SuspiciousOktaAccountEnumeration
Suspicious OneLogin MFA fatigue
Description:A suspicious IP address sent several OneLogin multifactor authentication (MFA) challenge attempts for a user account. An attacker might have compromised the user's account credentials and is trying to flood and bypass the MFA mechanism.		 Medium T1110.003 xdr_OneLoginMfaFatigue
Security alert name Severity MITRE Technique Detector ID
--- --- --- ---
Guest user account promoted to member
Description:A guest (external) user account was promoted to a member (internal) account. Guest accounts typically have restricted access, while member accounts are treated as internal users and may inherit broader permissions, access to resources, and eligibility for privileged roles. This can also be abused by adversaries to escalate privileges, bypass external access restrictions, or establish persistence within the tenant.		 Medium T1098 xdr_GuestToMemberPromotion
Malicious registration of a device with strong MFA
Description:A new Microsoft Authenticator device was registered to the account shortly after compromise, enabling persistent attacker access through an attacker controlled MFA method.		 MediumHigh T1556.006, T1098.005 xdr_MFAMethodAdditionxdr_MFADeviceRegistrationByCompromisedUser
Multifactor authentication method added for a privileged Okta account
Description:A new multifactor authentication method was registered for {TargetAliasName}, a privileged Okta account. This activity might indicate that an attacker who compromised the account registered their own authenticator to maintain persistent access, allowing continued sign-in even after a password reset. Privileged accounts also enroll new authenticators for legitimate reasons, such as replacing a lost or upgraded device, so confirm whether the enrollment was expected.		MediumT1556.006xdr_OktaPrivilegedAccountMfaAdded
OAuth app created a user
Description:A new user account was created by an OAuth application. An attacker might have compromised this application for persistence in the organization.		 Medium T1136.003 xdr_OAuthAppCreatedAUser
Okta privileged API token created
Description:{ActorAliasName} created an API token. If stolen, it can grant the attacker access with the user's permission.		 High T1078.004 xdr_OktaPrivilegedApiTokenCreated
Okta privileged API token updated
Description:{ActorAliasName} updated a Privileged API token Configuration to be more promiscuous. If stolen, it can grant the attacker access with the user's permission.		 High T1078.004 xdr_OktaPrivilegedApiTokenUpdated
Password of a privileged Okta account was reset by another account
Description:Another identity reset the password for {TargetAliasName}, a privileged Okta account. This activity might indicate unauthorized administrative access and an attempt to take control of the privileged account. Unauthorized control of this account might provide access to its assigned roles and associated resources. Administrators and help desk staff also reset passwords for legitimate reasons, such as recovering a locked-out account, so confirm whether the reset was requested.		MediumT1098xdr_OktaPrivilegedAccountPasswordReset
Reciprocal Temporary Access Pass creation between users
Description:Two users created Temporary Access Passes (TAPs) for each other within a short time window. This behavior may indicate a compromised account establishing circular persistence by using TAP credentials and then removing traces of the temporary credential.		 High T1098 xdr_ReciprocalTAPCreationViaGraphAPI
Secondary identity provider added in Okta
Description:{ActorAliasName} added a secondary identity provider (IdP) in Okta. This activity might establish an unauthorized federation trust that enables persistent access or unauthorized account provisioning.		HighT1484.002, T1556xdr_OktaSecondaryIdpAdded
Shadow credentials added to account
Description:A shadow credential injection has been detected on the account. This could be an indication of persistence or lateral movement. Attackers inject shadow credentials to Active Directory (AD) accounts to gain or maintain access to the account they're hacking.		 High T1098 xdr_ShadowCredentialsAttack
Shadow Credentials Added to Account and Used for Authentication
Description:An account had shadow credentials injected into it, and they have been used for authentication. When this happens, attackers could bypass traditional credential theft methods to gain persistent access to a user account. Aside from persistence, this could also be an indication of lateral movement.		 High T1098 xdr_ShadowCredentialsAttack
Suspicious addition of ACL on-premises
Description:Suspicious addition of ACL on-premises has been observed. This can lead to unauthorized access, gaining elevated permissions, account and resource compromise, lateral movement, among others. Investigate immediately to mitigate associated security risks.		 High T1098 xdr_SuspiciousAdditionOfAcl
Suspicious addition of default third‑party MFA method to user account
Description:A new third‑party multifactor authentication method was set as the default for a user account. Changing the default MFA provider could allow sign‑ins to be approved outside of the organization’s standard authentication flow and might indicate account manipulation intended to persist access or weaken enforcement. Go through the Recommendation section to immediately investigate and mitigate associated risks.		 Medium T1556.006 xdr_Suspicious3rdPartyMfaAddition
Suspicious addition of email
Description:New email was added for multiple users in a suspicious way. An attacker might have done this to gain persistence in the organization.		 Medium T1556.006 xdr_SuspiciousMFAAddition
Suspicious change to primary group ID
Description:A user's primary group ID was modified. An attacker might have compromised a user account and assigned a backdoor user with strong permissions in the domain for later use.		 High T1098 xdr_SuspiciousChangeInUserPrimaryGroupId
Suspicious credential change to an Entra Connect Sync application
Description:A user or another application modified credentials for a Microsoft Entra Connect Sync provisioning application. This activity might indicate that the application was compromised and could be used for malicious activities.		LowT1098xdr_EntraConnectSyncAppCredentialChange
Suspicious Entra device join or registration
Description:A user was suspiciously registered or joined into a new device to Entra. An attacker might have compromised the user account to perform persistence and lateral movement. Investigate immediately to mitigate associated security risks.		 Medium T1098.005 xdr_SuspiciousAdditionOfEntraDevice
Suspicious Entra device join or registration
Description:A user was suspiciously registered or joined into a new device to Entra, originating from an IP address identified by Microsoft Threat Intelligence. An attacker might have compromised the user account to perform persistence and lateral movement. Investigate immediately to mitigate associated security risks.		HighT1098.005xdr_SuspiciousDeviceRegistration
Suspicious Entra role addition
Description:A user was suspiciously assigned to a sensitive role. An attacker might have compromised the user account to perform persistence and lateral movement. Investigate immediately to mitigate associated security risks.		 Medium T1098.003 xdr_SuspiciousAdditionOfRoleToUser
Suspicious guest user invitation
Description:A new guest user was invited and accepted in a suspicious way. An attacker might have compromised a user account in the organization and is using it to add an unauthorized user for persistence purposes.		MediumT1136.003xdr_SuspiciousGuestUserInvitation
Suspicious Intune device registration activity
Description:Microsoft Entra ID detected a potentially suspicious device registration attempt in Microsoft Intune. The device enrollment activity deviates from normal user or organizational behavior and may indicate unauthorized device onboarding or account misuse. Review the registering user, device details, location, and authentication context to confirm whether the registration was legitimate.		 Medium T1098.005 xdr_SuspiciousIntuneDeviceRegistration
Suspicious MFA tampering activity by admin account
Description:An administrator account performed multifactor authentication (MFA) tampering activity after a risky authentication. An attacker might have compromised an admin account to manipulate MFA settings for possible lateral movement activity.		 Low T1556.006 xdr_AdminAccountTakeover
Suspicious removal of privileged app role assignment through Graph API
Description:A privileged app role assignment was deleted through Microsoft Graph API. This activity might indicate unauthorized removal or modification of application privileges.		 High T1114 xdr_SuspiciousAppRoleAssignmentDeletion
Suspicious resource-based constrained delegation (RBCD) attribute change
Description:One or more suspicious Resource-Based Constrained Delegation (RBCD)-related Active Directory (AD) attribute changes were detected. Such activity is often an initial step in RBCD attacks and might allow an attacker to impersonate users when accessing the targeted account affected by the RBCD attribute change. This behavior might indicate an attacker's attempt to achieve privilege escalation and establish persistence within the organization.		 Medium T1098 xdr_SuspiciousRbcdAttributeChange
Suspicious service principal sign-in following credential addition
Description:AnomalousSuspicious Service Principal sign sign-in to access {ResourceDisplayName} detected, shortly after new credentials are added. Such activity may indicate application persistence, unauthorized credential implantation, privilege escalation, or Service Principal compromise.		 Medium T1098.001 xdr_AnomalousSPNSignInAfterCredAddition
Suspicious sign‑sign-in by a user exhibiting a spike in account update activity
Description:A user account that exhibited an unusual increase in account update operations, including changes to authentication methods such as the removal of multifactor authentication (MFA), was also observed performing a suspicious sign‑in activity. This pattern might indicate attempts to modify authentication settings or access the account in a manner consistent with unauthorized use.		 Medium T1098 xdr_SuspiciousSpikeUserUpdate
User was created and assigned to Global Administrator role
Description:A new user was created and assigned to Global Administrator role. An attacker might have compromised the user account to perform persistence and lateral movement.		 High T1136.003, T1098.003 xdr_SuspiciousUserCreationAndSensitiveRoleAssignment
User was created and assigned to sensitive role
Description:A new user was created and assigned to a sensitive role. An attacker might have compromised the user account to perform persistence and lateral movement.		 Medium T1136.003, T1098.003 xdr_SuspiciousUserCreationAndSensitiveRoleAssignment
Security alert name Severity MITRE Technique Detector ID
Anomalous activity following Global Administrator elevation
Description:Anomalous behavior was observed on a user account around Global Administrator role elevation. The activity includes unusual Graph API patterns such as persistence, credential manipulation, policy changes, and reconnaissance, along with burst call behavior, failed access attempts, and risky sign-in events from unfamiliar locations or devices. This activity might indicate credential abuse, privilege escalation, backdoor creation, or compromise of the elevated Global Administrator account.		 Medium T1078.004, T1098 xdr_AnomalousGlobalAdminActivity
Okta privilege escalation following anomalous sign in by {ActorAliasName}Malicious Kerberos activity and CVE-2025-33073 exploitation attempt
Description:An anomalous Okta sign in attempt (event {AnomalousLoginEventId}) at {AnomalousLoginTime} from IP address {IPAddress}to exploit CVE-2025-33073 vulnerability was followed by privileged action {PrivilegedActionType} withindetected on this device. An attacker might have coerced this device into unauthorized authentication. When an attacker registers or spoofs a malicious DNS record containing a specially crafted string (1UWhR), a victim device could be coerced to authenticate (for example, through PetitPotam). It resolves the same session {SessionId} at {Timestamp}. Time delta between events: {DeltaSeconds}s.malicious DNS name and depending on the configuration, either sends a Kerberos Ticket-Granting Service (TGS) to the attacker's device, for a service like a Common Internet File System (CIFS) to the victim device, or performs local New Technology LAN Manager (NTLM) authentication. The attacker then receives the TGS ticket and could use it to perform malicious activities such as dumping the Security Account Manager (SAM) database.		 High T1110, T1548T1187 xdr_OktaPrivilegeEscalationFollowingSignInxdr_SuspectedKerberosReflection
Okta consent grant from a risky context
Description:An Okta user successfully granted administrative OAuth consent to an application during a risky session. Okta flagged the session for medium or high risk or suspected threat activity. This activity might indicate that an unauthorized party used the account to grant application permissions. The grant could provide persistent access to data or APIs until the permissions and associated tokens are revoked. Verify whether a legitimate administrator approved the grant.		MediumT1098xdr_OktaConsentGrantFromRiskyContext
Okta session impersonation leading to privileged action for {AccountUpn}
Description:An Okta impersonation session (event {ImpersonationStartEventId}) was initiated at {ImpersonateSessionTime} from IP address {IPAddress}. A privileged action {PrivilegedActionType} occurred within the same session {SessionId} at {Timestamp}. The time between events was {DeltaSeconds}s		 High T1548, T1134 xdr_OktaUserSessionImpersonationPrivilegedAction
Potential Certighost (CVE-2026-54121) AD CS abuse
Description:Activity associated with potential Certighost (CVE-2026-54121) abuse was detected in Active Directory Certificate Services (AD CS). This activity may indicate an attempt to abuse certificate enrollment or certificate-based authentication to impersonate a privileged identity, including a domain controller, and elevate privileges in the domain.		 High T1649, T1550.003 xdr_CertighostAdcsChaseAbuse
Risky sign in followed by privilege role grant
Description:A user account flagged with a high risk Microsoft Entra sign in assessment was assigned to a high privilege directory role such as Global Administrator or Privileged Role Administrator shortly after logging in, using the Add member to role operation. This sequence strongly suggests a compromised credential followed by rapid privilege escalation.		 Medium T1078.004, T1098.003 xdr_RiskySignInFollowedByPrivilegedRoleGrant
Suspected certificate enrollment abuse (ESC15)
Description:A certificate was enrolled suspiciously. An attacker might be using the ESC15 technique to exploit CVE-2024-49019 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49019) and escalate privileges in the forest.		 High T1068 xdr_SuspectedCertificateEnrollmentESC15
Suspicious Active Directory Certificate Services (AD CS) certificate request
Description:A suspicious certificate request was detected to Active Directory Certificate Services (AD CS) with anomalous characteristics that may indicate an attempt to abuse certificate enrollment for privilege escalation or impersonation of another identity.		HighT1649xdr_SuspiciousCertificateRequest
Suspicious Active Directory Certificate Services (AD CS) misconfigured certificate template abuse (ESC1)
Description:A certificate request was detected using a template that allows the requester to supply arbitrary Subject Alternative Name (SAN) values. This may indicate an ESC1 Active Directory Certificate Services (AD CS) abuse attack, in which an attacker requests a certificate capable of authentication (Client Authentication / PKINIT) and impersonates another user or privileged account, potentially gaining unauthorized access to domain resources.		HighT1649xdr_AdcsMisconfigTemplateAbuseEsc1
Suspicious addition and removal of elevated privileges
Description:A high-privilege Entra ID role (for example, Global Administrator or Privileged Role Administrator) was granted to user or service principal and was quickly revoked after. This rapid role assignment and removal pattern is uncommon in regular administrative workflows and might indicate an attempt to evade detection during privilege escalation. Investigate this alert immediately to prevent or mitigate any unauthorized access, privilege escalation, and security breach.		 Medium T1078.004 xdr_SuspiciousAdditionAndRemovalOfPrivilegedRole
Suspicious Entra domain addition observed
Description:A domain addition classified as suspicious by Microsoft Threat Intelligence has been observed.\ No newline at end of file		 Medium T1484.002 xdr_SuspiciousEntraDomainAddition
Suspicious SPN was added to a user
Description:A suspicious service principal name (SPN) was added to a sensitive user. An attacker might be attempting to gain elevated access for lateral movement within the organization.		 High T1098 xdr_SuspiciousAdditionOfSpnToUser

Exfiltration alerts

Security alert nameSeverityMITRE TechniqueDetector ID
\ No newline at end of filePossible data exfiltration over DNS
Description:Possible data exfiltration over DNS has been detected. A threat actor may have encoded data within DNS queries to exfiltrate information from the environment while evading traditional network security controls.		 Medium T1048.003, T1071.004 xdr_PossibleDnsDataExfil
\ No newline at end of file