domains / families / security / detecting-entra-offensive-tools-in-graph-logs

detecting-entra-offensive-tools-in-graph-logs

separate

Hunt AADGraphActivityLogs and MicrosoftGraphActivityLogs in Microsoft Sentinel/Log Analytics using KQL to fingerprint offensive Entra ID enumeration tools such as ROADtools, AADInternals, and AzureHound, including User-Agent signatures, roadrecon endpoint sweeps, and sign-in correlation. Use when investigating suspicious Microsoft Graph API activity, Entra ID reconnaissance, or building Sentinel analytics rules to detect these tools.

When to use

• Building or tuning detections for Microsoft Sentinel / Log Analytics covering Entra ID
• Threat hunting after suspected credential theft, device-code phishing, or OAuth consent abuse
• Purple-team exercises validating that ROADtools/AADInternals/AzureHound activity is detectable
• Investigating an alert and needing to correlate Graph API calls back to a sign-in/session
• Closing the legacy Azure AD Graph visibility gap after enabling AADGraphActivityLogs

Skill page

Source