Clankerusecase
Azure detection coverage
 ← Back to main site
Home/ Targets/ Azure

⛅Azure detections

Clankerusecase tracks 70 detection use cases covering the Azure attack surface across 68 MITRE ATT&CK techniques.

Detections targeting Microsoft Azure — Activity Logs, Azure AD, Sentinel SecurityEvent / SigninLogs.

Open Detection Library → View on the matrix
70Use cases
68Techniques
60Articles
6Kill-chain phases

Top techniques on Azure (25)

T1078.004Cloud Accounts13T1528Steal Application Access Token11T1190Exploit Public-Facing Application8T1098Account Manipulation6T1566.002Spearphishing Link6T1550.001Application Access Token5T1195.002Compromise Software Supply Chain5T1567Exfiltration Over Web Service5T1071.001Web Protocols5T1556Modify Authentication Process4T1098.001Additional Cloud Credentials4T1098.005Device Registration4T1530Data from Cloud Storage4T1078Valid Accounts4T1556.006Multi-Factor Authentication4T1072Software Deployment Tools4T1021.007Cloud Services4T1114.003Email Forwarding Rule4T1552.001Credentials In Files3T1566.001Spearphishing Attachment3T1098.003Additional Cloud Roles3T1136.003Cloud Account3T1564.008Email Hiding Rules3T1485Data Destruction2T1621Multi-Factor Authentication Request Generation2

Reconnaissance (1)

[LLM] n8n-MCP cross-tenant workflow version read/enumeration via n8n_workflow_versions (CVE-2026-54052) Bespoke recon · hunting SP

Delivery (8)

Azure AD brute-force login Internal delivery · alerting DD Email attachment opened from external sender Internal delivery · hunting DSP Phishing-link click correlated to endpoint execution Internal delivery · alerting DSP Microsoft Teams external-tenant chat from unverified IT-helpdesk impersonator Internal delivery · hunting DSP [LLM] EvilTokens device-code token polling from attacker infra (python-requests UA / C2 IPs) Bespoke delivery · hunting DSΣPDD [LLM] Silver Fox Japan tax-season lure: inbound email with Japanese HR/ESOP subject + gofile.io URL or RAR/ZIP Bespoke delivery · alerting DS [LLM] PlugX phishing lure — 'Meeting Invitation' email linking to gesecole.net ZIP Bespoke delivery · hunting DSΣPDD [LLM] Inbound email with HTML attachment linking to unpkg.com Beamglea package Bespoke delivery · alerting DSP

Exploitation (10)

[WEEKLY] Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint Internal exploit · alerting DSPDD [WEEKLY] Sub-admin grants Owner/Administrator role then grantee signs in from a different source within 60 minutes Internal exploit · alerting DSPDDCW [LLM] Spike of AADSTS50011 redirect_uri mismatch at IdP (poisoned Poweradmin callback) Bespoke exploit · alerting DSPDD [LLM] Entra ID Device Authorization Grant (device code) authentication flow sign-in Bespoke exploit · alerting DSΣPDD [LLM] Microsoft 365 OAuth device code authentication flow sign-in (EvilTokens) Bespoke exploit · hunting DSΣPDD [LLM] BodySnatcher (CVE-2025-12420) — Hardcoded 'servicenowexternalagent' Token Observed in HTTP Traffic Bespoke exploit · alerting DSΣPDDCS [LLM] ServiceNow Virtual Agent Invocation of Hidden AIA-Agent Invoker AutoChat Topic (CVE-2025-12420) Bespoke exploit · alerting DSPDDCS [LLM] Anomalous POST to Next.js Server Action / RSC endpoint with 5xx error clustering Bespoke exploit · alerting DSPDDCS [LLM] Next.js CVE-2025-29927 middleware bypass via x-middleware-subrequest header Bespoke exploit · alerting DSΣPDDCS [LLM] Struts CVE-2023-50164 path-traversal upload — HTTP exploit attempt Bespoke exploit · alerting DSΣPDD

Installation (10)

Azure AD member assigned Global Administrator role Internal install · alerting DD Azure AD MFA disabled for a user Internal install · alerting DD Azure diagnostic setting deleted Internal install · alerting DD Azure new owner added to service principal Internal install · alerting DD Azure SQL Server firewall rule created Internal install · alerting DD Azure user added to administrative group Internal install · alerting DD [LLM] OWAReaper server-side persistence: Owner rights granted to 'Default' user on mailbox folders Bespoke install · alerting DSΣP [LLM] Entra helpdesk password reset immediately followed by new MFA method registration (ShinyHunters ATO) Bespoke install · alerting SPDD [LLM] New attacker device registered/joined to Microsoft Entra ID Bespoke install · hunting DSΣPDD [LLM] Entra ID device registration = ARToken PRT persistence after device-code token theft Bespoke install · hunting DSΣDD

Command & Control (7)

[WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD [LLM] Suspicious OAuth application consent granting broad scopes (ShinyHunters DataLoader-style persistence) Bespoke c2 · hunting DSΣPDD [LLM] FrostyNeighbor C2 callout to needbinding/nebao/algsat/sardk/alexavegas/lavanille Bespoke c2 · alerting DSΣPDDCS [LLM] Suspicious draft email manipulation against barrantaya.1010@outlook.com (BoxOfFriends Graph API C2) Bespoke c2 · hunting DSPDDCS [LLM] TeamPCP Trivy/KICS C2 callback to scan.aquasecurtiy.org / 45.148.10.212 Bespoke c2 · hunting DSΣPDD [LLM] axios npm RAT C2 beacon to sfrclak.com / 142.11.206.73:8000 Bespoke c2 · hunting DSΣPDD [LLM] TeamPCP supply-chain C2 — outbound to checkmarx[.]zone / 83.142.209.11 Bespoke c2 · hunting DSΣPDD

Actions on Objectives (34)

Azure Key Vault keys / secrets read Internal actions · alerting DD Azure storage soft-delete disabled Internal actions · alerting DD MFA fatigue / push-bombing Internal actions · alerting DSP OAuth consent / suspicious app grant Internal actions · alerting DSΣP [WEEKLY] Vendor / Third-Party OAuth App or SP Sign-in From Unbaselined Egress Followed by Bulk SaaS Object Read Internal actions · alerting DSPDD Azure AD FullAccessAsApp Permission Assigned ESCU actions · alerting P Azure AD Multi-Factor Authentication Disabled ESCU actions · alerting P Azure AD New MFA Method Registered For User ESCU actions · alerting P Azure AD Privileged Graph API Permission Assigned ESCU actions · alerting P Azure AD Service Principal New Client Credentials ESCU actions · alerting P Azure AD Service Principal Privilege Escalation ESCU actions · alerting P Azure Automation Account Created ESCU actions · alerting P Azure Automation Runbook Created ESCU actions · alerting P Azure Runbook Webhook Created ESCU actions · alerting P Microsoft Intune Device Health Scripts ESCU actions · hunting P Microsoft Intune DeviceManagementConfigurationPolicies ESCU actions · hunting P Microsoft Intune Manual Device Management ESCU actions · hunting P Microsoft Intune Mobile Apps ESCU actions · hunting P [LLM] Bulk M365 / SharePoint / OneDrive file download by a single identity (cloud data theft) Bespoke actions · alerting DSP [LLM] SSO application-access burst — one identity authenticating to many distinct SaaS apps in a short window Bespoke actions · alerting DSPDD [LLM] Exposed-credential reuse: one identity authenticating to 3+ distinct cloud services within 1 hour Bespoke actions · alerting DSDDCW [LLM] Victim account takeover: new-IP sign-in within 1h of redirect_uri mismatch (CVE-2026-54588) Bespoke actions · alerting DSP [LLM] Post-compromise malicious inbox rule for defense evasion (UAT-11764 / ARToken BEC) Bespoke actions · hunting DSDD [LLM] n8n-MCP destructive workflow version backup deletion (delete/prune/truncate) — CVE-2026-54052 impact Bespoke actions · alerting SΣP [LLM] Malicious postmark-mcp BCC email exfiltration to phan@giftshop[.]club Bespoke actions · alerting DSP [LLM] Post-device-code token abuse: mailbox / OneDrive / Teams access from a new IP after device-code sign-in Bespoke actions · alerting DS [LLM] ARToken BEC toolkit: inbox forwarding/hiding rule creation on compromised M365 mailbox Bespoke actions · hunting DSΣ [LLM] Post-device-code malicious inbox rule creation (BEC prep) Bespoke actions · alerting DSP [LLM] postmark-mcp BCC exfil to giftshop.club Bespoke actions · alerting DSΣPDDCS [LLM] Iran-aligned MFA push-bombing followed by new auth method registered (AA24-290A) Bespoke actions · alerting DSP [LLM] Shai-Hulud 3.0 'Goldox-T3chs' GitHub exfiltration marker observed Bespoke actions · alerting DSΣPDDCS [LLM] Outbound email BCC'd to giftshop.club exfil domain (postmark-mcp backdoor) Bespoke actions · alerting DSΣPDD [LLM] Reuse of CircleCI-exfiltrated secrets / stolen SSO session from breach attacker IPs Bespoke actions · hunting DSΣPDDCSCW [LLM] Storage account key retrieval (listKeys) inside an ARM/Bicep deployment — secret-in-output leak vector Bespoke actions · hunting SPDD

Recent articles citing Azure-targeted detections

crit Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet
crit Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
high Russian hackers exploit Exchange OWA zero-day for long-term mailbox access
high Four incident-response decisions from the Hugging Face breach
crit Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
high Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare
crit Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory
crit Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape
crit Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline
high Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments
crit Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser
crit Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass
crit OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach
crit New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
crit Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates
high CubePilot drone software dev hit by DNS hijacking to intercept traffic
crit [GHSA / CRITICAL] CVE-2026-54588: Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construct
high Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
crit 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login
crit JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach
crit Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root
crit Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains
crit Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
crit Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit
crit Mirage Kitten targets Middle East and Africa region with new malware
crit Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw
high NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework
crit Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption
crit Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw
crit n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process
high Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update
crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
crit TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments
high GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
high Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
crit Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
high Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
crit CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
crit Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
crit DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials
crit [GHSA / CRITICAL] GHSA-r277-6w6q-xmqw: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Defa
crit [GHSA / CRITICAL] GHSA-rjg6-39jm-rgg4: @better-auth/scim: account takeover and stale access via SCIM provider-id collision
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
high ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
crit Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
crit Golden Chickens Resurfaces With Four New Malware Families and Modular Implants
crit NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats
crit Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say
crit Email threat landscape: Q2 2026 trends and insights
crit Russian Global Webmail Espionage
high Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization
crit [GHSA / CRITICAL] CVE-2026-56750: Gitea Remember-Me Token Theft Not Invalidating Attacker Session
high Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters
high New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery
high ACR Stealer: Two observed intrusion chains amid increased threat activity
crit AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report
crit Begun, the Patch Wars have