T1528Credential AccessAdvancedDefense plan →

Azure / Entra ID Identity Attacks: From Token Theft to Golden SAML — Cloud Identity Security

HARDEC · Savunma Güvenliği Ekibi·Published: June 13, 2026·Updated: July 15, 2026·14 min read

A comprehensive map of attacks targeting the Microsoft Entra ID (formerly Azure Active Directory) identity model: technical reference for purple/red teams and SOC teams, from token theft, device code phishing, Golden SAML, and managed identity abuse through to detection and hardening.

Exploit

Prevention

Detection

Defense profile:7 detection rules 8 mitigations 10 baseline controls 3 response playbooks

Swipe or use the arrows to move between sections

Section 1 / 3

Zafiyet (Vulnerability)

Tehdit bağlamı, zafiyet ve istismar senaryosu

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 2 / 3

Prevention & Hardening

Savunma teknolojileri, policy ve sertleştirme

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Section 3 / 3

Detection

Davranış, loglama ve detection kuralları

Beta

This section is not open yet

Titles and summaries are free. The detail of this section is not published yet. You can request the offline comparison tool for the open environments with a company email.

Request the offline tool →

Information note

Cloud identity security: Hybrid identity synchronization components such as Azure AD Connect create a critical trust point for both on-premises and cloud environments; the server hosting this component should be evaluated under security requirements equivalent to those of a Domain Controller. To prevent Golden SAML attacks, AD FS token-signing certificates and service account credentials must be protected under strict conditions. Microsoft Defender for Identity provides the ability to monitor anomalous authentication patterns on both the on-premises and cloud sides from a single interface (MITRE ATT&CK T1606.002).

Detection rules

Directly copyable rules (Sigma/KQL/…) that detect this technique. Each rule specifies its required telemetry, maturity, and source.

HackTool - Koh Default Named Pipe

Detects creation of default named pipes used by the Koh tool

critical

sigmaTest

Show ruleHide rule

title: HackTool - Koh Default Named Pipe
id: 0adc67e0-a68f-4ffd-9c43-28905aad5d6a
status: test
description: Detects creation of default named pipes used by the Koh tool
references:
    - https://github.com/GhostPack/Koh/blob/0283d9f3f91cf74732ad377821986cfcb088e20a/Clients/BOF/KohClient.c#L12
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-08
modified: 2023-08-07
tags:
    - attack.privilege-escalation
    - attack.credential-access
    - attack.stealth
    - attack.t1528
    - attack.t1134.001
logsource:
    product: windows
    category: pipe_created
    definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'
detection:
    selection:
        PipeName|contains:
            - '\imposecost'
            - '\imposingcost'
    condition: selection
falsepositives:
    - Unlikely
level: critical

Not validated

Telemetry required to run: windows; Named Pipe Eventswindows / pipe_createdwindows

False positive: Unlikely

Source: SIGMA · Detection Rule License (DRL) 1.1 · original rule

Mitigations

Prevention and hardening measures that mitigate or block this technique.

Audit

Prevention

Advanced audit policy + command-line auditing + Sysmon + directory access auditing: the telemetry that detection requires.

Information note

Informational note: Default Windows audit policies are insufficient; critical events such as failed logons, sensitive privilege use, and object access require additional configuration. Process creation command-line records and network connection logs must be collected with Sysmon. On Linux, auditd default settings are extremely minimal and must be customized for security use cases. Since collection is impossible without log generation, audit policy configuration must be completed before SIEM integration.

Cloud IAM Hardening

Hardening

Hardens cloud identity/access management with least privilege, no persistent keys, comprehensive cross-account controls, and continuous analysis.

Conditional Access

Hardening

The central policy engine of Entra authentication with signal-based (user/device/location/risk) access decisions.

Baseline controls against this technique

The following security baseline controls mitigate this technique. Compare your organization's configuration against the relevant baseline by .

Response playbooks

NIST/SANS phase-based response workflows to follow when this technique is detected.

Techniques in the Credential Access tactic

T1003.001Credential AccessAdvanced

A comprehensive map of NT hash, Kerberos ticket, and plaintext password theft via memory dumping of Windows authentication backbone LSASS (lsass.exe): Mimikatz/sekurlsa, comsvcs LOLBin, ProcDump, and nanodump attack methods; Sysmon EID 10 GrantedAccess masks + Sigma-based technical detection; Credential Guard, RunAsPPL, WDigest disable, and ASR rule hardening controls.

June 13, 202631 min read

Exploit

Prevention

Detection

References

MITRE ATT&CK — T1528: Azure / Entra ID Identity Attacks: From Token Theft to Golden SAML — Cloud Identity Security ↗

This article is based on the MITRE ATT&CK framework; the detection, defense, and response content was prepared independently.

Application URI Configuration Changes

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

high

sigmaTest

Show ruleHide rule

title: Application URI Configuration Changes
id: 0055ad1f-be85-4798-83cf-a6da17c993b3
status: test
description: |
    Detects when a configuration change is made to an applications URI.
    URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
date: 2022-06-02
tags:
    - attack.initial-access
    - attack.stealth
    - attack.t1528
    - attack.t1078.004
    - attack.persistence
    - attack.credential-access
    - attack.privilege-escalation
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        properties.message: Update Application Sucess- Property Name AppAddress
    condition: selection
falsepositives:
    - When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.
level: high

Not validated

Telemetry required to run: azure; auditlogsazure / auditlogsazure

False positive: When and administrator is making legitimate URI configuration changes to an application. This should be a planned event.

Source: SIGMA · Detection Rule License (DRL) 1.1 · original rule

title: Entra ID - Kullanici Tarafindan OAuth Uygulamasina Izin Verildi id: e7c1f6a4-28b9-4e3d-a5c8-1b4e7f9d2c36 status: experimental description: | Microsoft Entra ID denetim gunluklerinde bir kullanicinin OAuth uygulamasina onay verdigi olaylari tespit eder. Illicit consent grant saldirilarinda (T1528) saldirganlar kullanicilari zararli OAuth uygulamalarini yetkilendirmeye yonlendirir; bu sayede kullanicinin token'i olmadan kalici e-posta/dosya erisimi kazanirlar. Yuksek riskli izinler (Mail.Read, Files.ReadWrite.All vb.) iceren onaylar ozellikle suphelidir. Kural AI tarafindan uretilmis / dogrulanmamistir. references: - https://attack.mitre.org/techniques/T1528/ - https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/protect-against-consent-phishing - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/azure_illicit_oauth_grant.yml - https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/ author: CyberSecLab (AI) date: 2026-06-13 modified: 2026-06-13 tags: - attack.t1528 - attack.credential_access logsource: product: azure service: auditlogs detection: selection_consent: OperationName: 'Consent to application' ResultType: 'success' selection_high_risk_permissions: TargetResources|contains: - 'Mail.Read' - 'Mail.ReadWrite' - 'Mail.Send' - 'Files.ReadWrite.All' - 'Directory.ReadWrite.All' - 'RoleManagement.ReadWrite.Directory' - 'AppRoleAssignment.ReadWrite.All' - 'Application.ReadWrite.All' - 'User.ReadWrite.All' - 'offline_access' filter_admin_consent: InitiatedBy|contains: 'Global Administrator' OperationName: 'Consent to application' AdditionalDetails|contains: 'adminConsent=True' condition: selection_consent and selection_high_risk_permissions and not filter_admin_consent falsepositives: - Btimsec veya IT yoneticileri tarafindan yetkilendirilen kurumsal uygulamalar - Microsoft 365 entegrasyonlari (Teams, SharePoint vb.) - Mesgru is uygulamalari ilk kurulum sirasinda genis izin isteyebilir level: high

title: Entra ID - Uygulama veya Servis Sorumlusuna Yeni Kimlik Bilgisi Eklendi id: f4a2d8c5-19e7-4f1b-b6d3-8c2e5a1f4b97 status: experimental description: | Microsoft Entra ID'de mevcut bir uygulamaya veya servis sorumlusuna (service principal) yeni sertifika veya client secret eklenmesini tespit eder. Bu eylem (T1528) saldirganin ele gecirdigi uygulamaya kalici erisim saglamak veya calinan OAuth token'i yenilemek icin kullanilir. Mesgru olmayan kimlik bilgisi ekleme islemleri, ozellikle is saatleri disinda veya yabanci IP'den yapilanlari, ciddi tehdit gostergesidir. Kural AI tarafindan uretilmis / dogrulanmamistir. references: - https://attack.mitre.org/techniques/T1528/ - https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/azure_app_credential_added.yml - https://www.mandiant.com/resources/blog/detecting-microsoft-365-azure-active-directory-backdoors author: CyberSecLab (AI) date: 2026-06-13 modified: 2026-06-13 tags: - attack.t1528 - attack.credential_access - attack.persistence logsource: product: azure service: auditlogs detection: selection_credential_added: OperationName|contains: - 'Add service principal credentials' - 'Update application – Certificates and secrets management' - 'Add application' ResultType: 'success' filter_known_devops: InitiatedBy|contains: - 'Azure DevOps' - 'GitHub Actions' - 'Terraform' - 'Managed Identity' condition: selection_credential_added and not filter_known_devops falsepositives: - Mesgru DevOps/CI-CD surecleri (GitHub Actions, Azure DevOps pipeline) uygulama sirri olusturabilir - Uygulama sertifika yenileme (yillik rutin) - BT yoneticileri tarafindan yapilan yetkilendirilmis degisiklikler level: medium

Azure / Entra ID Identity Attacks: From Token Theft to Golden SAML — Cloud Identity Security

Zafiyet (Vulnerability)

This section is not open yet

Prevention & Hardening

This section is not open yet

Detection

This section is not open yet

Detection rules

HackTool - Koh Default Named Pipe

Mitigations

Audit

Cloud IAM Hardening

Conditional Access

Baseline controls against this technique

Response playbooks

Techniques in the Credential Access tactic

References

Anomalous Token

Anonymous IP Address

App Granted Microsoft Permissions

Application URI Configuration Changes

Entra ID Malicious OAuth Application Consent Grant

Entra ID Service Principal Credential Addition

Identity Provider (IdP) Hardening

Identity Threat Detection and Response (ITDR)

Restrict Web-Based Content

User Account Management

User Training

Kerberos Ticket Attacks: From Kerberoasting to Ticket Forgery

Microsoft Graph API and Permission Abuse: Illicit Consent, Application Roles, and OAuth Attacks

Azure / Entra ID Management Plane Compromise — Application Persistence, Role Takeover, and Golden SAML

Microsoft Graph API Unauthorized Consent and OAuth Consent Abuse Response

Azure / Entra ID Token and Credential Harvesting Response