Clankerusecase
Azure detection coverage
 ← Back to main site
Home/ Targets/ Azure

⛅Azure detections

Clankerusecase tracks 71 detection use cases covering the Azure attack surface across 72 MITRE ATT&CK techniques.

Detections targeting Microsoft Azure — Activity Logs, Azure AD, Sentinel SecurityEvent / SigninLogs.

Open Detection Library → View on the matrix
71Use cases
72Techniques
60Articles
6Kill-chain phases

Top techniques on Azure (25)

T1078.004Cloud Accounts17T1528Steal Application Access Token10T1190Exploit Public-Facing Application8T1098Account Manipulation6T1098.001Additional Cloud Credentials6T1566.002Spearphishing Link6T1621Multi-Factor Authentication Request Generation5T1078Valid Accounts4T1195.002Compromise Software Supply Chain4T1072Software Deployment Tools4T1021.007Cloud Services4T1550.004Web Session Cookie4T1114.003Email Forwarding Rule4T1567Exfiltration Over Web Service4T1071.001Web Protocols4T1556Modify Authentication Process3T1552.001Credentials In Files3T1566.001Spearphishing Attachment3T1550.001Application Access Token3T1098.005Device Registration3T1556.006Multi-Factor Authentication3T1136.003Cloud Account3T1564.008Email Hiding Rules3T1562.008T1562.0082T1485Data Destruction2

Reconnaissance (1)

[LLM] n8n-MCP cross-tenant workflow version read/enumeration via n8n_workflow_versions (CVE-2026-54052) Bespoke recon · hunting SP

Delivery (10)

Azure AD brute-force login Internal delivery · alerting DD Email attachment opened from external sender Internal delivery · hunting DSP Phishing-link click correlated to endpoint execution Internal delivery · alerting DSP Microsoft Teams external-tenant chat from unverified IT-helpdesk impersonator Internal delivery · hunting DSP [LLM] Corporate sign-in from DPRK IT-worker VPS / AstrillVPN infrastructure (Famous Chollima) Bespoke delivery · hunting DSΣPDD [LLM] Successful Entra ID device-code authentication (ARToken/EvilTokens PhaaS MFA bypass) Bespoke delivery · hunting DSΣP [LLM] EvilTokens device-code token polling from attacker infra (python-requests UA / C2 IPs) Bespoke delivery · hunting DSΣPDD [LLM] Silver Fox Japan tax-season lure: inbound email with Japanese HR/ESOP subject + gofile.io URL or RAR/ZIP Bespoke delivery · alerting DS [LLM] PlugX phishing lure — 'Meeting Invitation' email linking to gesecole.net ZIP Bespoke delivery · hunting DSΣPDD [LLM] Inbound email with HTML attachment linking to unpkg.com Beamglea package Bespoke delivery · alerting DSP

Exploitation (12)

[WEEKLY] Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint Internal exploit · alerting DSPDD [WEEKLY] Sub-admin grants Owner/Administrator role then grantee signs in from a different source within 60 minutes Internal exploit · alerting DSPDDCW [LLM] Entra ID password spray: many distinct accounts failing auth from few source IPs Bespoke exploit · alerting DSPDD [LLM] Entra ID MFA fatigue: burst of MFA-challenge failures followed by a successful MFA sign-in Bespoke exploit · alerting DSPDD [LLM] Spike of AADSTS50011 redirect_uri mismatch at IdP (poisoned Poweradmin callback) Bespoke exploit · alerting DSPDD [LLM] OAuth device-code authorization flow sign-in (ARToken/EvilTokens MFA bypass) Bespoke exploit · hunting DSΣ [LLM] Microsoft 365 OAuth device code authentication flow sign-in (EvilTokens) Bespoke exploit · hunting DSΣPDD [LLM] BodySnatcher (CVE-2025-12420) — Hardcoded 'servicenowexternalagent' Token Observed in HTTP Traffic Bespoke exploit · alerting DSΣPDDCS [LLM] ServiceNow Virtual Agent Invocation of Hidden AIA-Agent Invoker AutoChat Topic (CVE-2025-12420) Bespoke exploit · alerting DSPDDCS [LLM] Anomalous POST to Next.js Server Action / RSC endpoint with 5xx error clustering Bespoke exploit · alerting DSPDDCS [LLM] Next.js CVE-2025-29927 middleware bypass via x-middleware-subrequest header Bespoke exploit · alerting DSΣPDDCS [LLM] Struts CVE-2023-50164 path-traversal upload — HTTP exploit attempt Bespoke exploit · alerting DSΣPDD

Installation (8)

Azure AD member assigned Global Administrator role Internal install · alerting DD Azure AD MFA disabled for a user Internal install · alerting DD Azure diagnostic setting deleted Internal install · alerting DD Azure new owner added to service principal Internal install · alerting DD Azure SQL Server firewall rule created Internal install · alerting DD Azure user added to administrative group Internal install · alerting DD [LLM] AI resource key creation paired with logging/alert teardown in cloud control plane Bespoke install · hunting SPDDCW [LLM] High-privilege OAuth consent grant to Flowise application (offline_access / Mail / Files) Bespoke install · hunting DSΣDD

Command & Control (5)

[WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD [LLM] FrostyNeighbor C2 callout to needbinding/nebao/algsat/sardk/alexavegas/lavanille Bespoke c2 · alerting DSΣPDDCS [LLM] Suspicious draft email manipulation against barrantaya.1010@outlook.com (BoxOfFriends Graph API C2) Bespoke c2 · hunting DSPDDCS [LLM] TeamPCP Trivy/KICS C2 callback to scan.aquasecurtiy.org / 45.148.10.212 Bespoke c2 · hunting DSΣPDD [LLM] TeamPCP supply-chain C2 — outbound to checkmarx[.]zone / 83.142.209.11 Bespoke c2 · hunting DSΣPDD

Actions on Objectives (35)

Azure Key Vault keys / secrets read Internal actions · alerting DD Azure storage soft-delete disabled Internal actions · alerting DD MFA fatigue / push-bombing Internal actions · alerting DSP OAuth consent / suspicious app grant Internal actions · alerting DSΣP [WEEKLY] Vendor / Third-Party OAuth App or SP Sign-in From Unbaselined Egress Followed by Bulk SaaS Object Read Internal actions · alerting DSPDD Azure AD FullAccessAsApp Permission Assigned ESCU actions · alerting P Azure AD Multi-Factor Authentication Disabled ESCU actions · alerting P Azure AD New MFA Method Registered For User ESCU actions · alerting P Azure AD Privileged Graph API Permission Assigned ESCU actions · alerting P Azure AD Service Principal New Client Credentials ESCU actions · alerting P Azure AD Service Principal Privilege Escalation ESCU actions · alerting P Azure Automation Account Created ESCU actions · alerting P Azure Automation Runbook Created ESCU actions · alerting P Azure Runbook Webhook Created ESCU actions · alerting P Microsoft Intune Device Health Scripts ESCU actions · hunting P Microsoft Intune DeviceManagementConfigurationPolicies ESCU actions · hunting P Microsoft Intune Manual Device Management ESCU actions · hunting P Microsoft Intune Mobile Apps ESCU actions · hunting P [LLM] First-time Entra directory enumeration via Graph/PowerShell CLI tooling by a user Bespoke actions · hunting DSPDD [LLM] Post-quishing cloud token replay: MFA-satisfied sign-in shortly after QR-attachment email Bespoke actions · alerting DSPDD [LLM] AiTM MFA-relay: successful Entra sign-in from AWS EC2 / hosting ASN Bespoke actions · hunting DSPDD [LLM] AitM session hijack: PaaS phishing-page visit followed by successful Entra sign-in from a different IP Bespoke actions · alerting DS [LLM] Entra ID sign-in or session from Storm-2945 AiTM device-code phishing infrastructure Bespoke actions · hunting DSΣPDD [LLM] Email-hiding inbox rules created post-compromise (BEC / mailbox concealment) Bespoke actions · hunting DSΣP [LLM] Victim account takeover: new-IP sign-in within 1h of redirect_uri mismatch (CVE-2026-54588) Bespoke actions · alerting DSP [LLM] Post-compromise M365 defense-evasion inbox rule creation (UAT-11764 mailbox takeover) Bespoke actions · hunting DSΣ [LLM] n8n-MCP destructive workflow version backup deletion (delete/prune/truncate) — CVE-2026-54052 impact Bespoke actions · alerting SΣP [LLM] Malicious postmark-mcp BCC email exfiltration to phan@giftshop[.]club Bespoke actions · alerting DSP [LLM] Post-device-code malicious inbox rule creation (BEC prep) Bespoke actions · alerting DSP [LLM] postmark-mcp BCC exfil to giftshop.club Bespoke actions · alerting DSΣPDDCS [LLM] Iran-aligned MFA push-bombing followed by new auth method registered (AA24-290A) Bespoke actions · alerting DSP [LLM] Shai-Hulud 3.0 'Goldox-T3chs' GitHub exfiltration marker observed Bespoke actions · alerting DSΣPDDCS [LLM] Outbound email BCC'd to giftshop.club exfil domain (postmark-mcp backdoor) Bespoke actions · alerting DSΣPDD [LLM] Reuse of CircleCI-exfiltrated secrets / stolen SSO session from breach attacker IPs Bespoke actions · hunting DSΣPDDCSCW [LLM] Storage account key retrieval (listKeys) inside an ARM/Bicep deployment — secret-in-output leak vector Bespoke actions · hunting SPDD

Recent articles citing Azure-targeted detections

crit CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
crit Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
high Hacker claims 3.6 million Azure account records stolen from major companies
high Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
crit [GHSA / CRITICAL] CVE-2026-64859: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
crit Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access
crit Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
crit How QR-code phishing can slip past corporate security measures
crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
high SafePal data breach impacts 39,798 customers, stolen info for sale
crit New AmnesiaStealer macOS malware hijacks browser sessions via remote control
high ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2
crit SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch
crit Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner
high Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware
high Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
high Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers
crit CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps
high Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware
crit APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit
crit China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud
high GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE
crit ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories
high Curiouser and Curiouser
crit New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure
crit AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS
crit WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud
crit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring
crit Dissecting the JWR phishing framework
crit Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
high 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
high OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning
crit Enterprise Defenses Recovered at the Edge and Collapsed Inside
crit Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
crit Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
crit Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
crit SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code
crit ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
crit Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
high The Agent Baseline: 35 Controls, But Where Should You Start?
crit Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack
high Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
crit Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client
crit Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
high DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
crit OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development
crit A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices
crit Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo
crit Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference part
crit Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers
high Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11
high Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets
crit Kimwolf v7: An Evolution of the Kimwolf Botnet
crit The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications
high Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise
crit DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
high Are AI tutors safe for your kids?
crit Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS