detecting-azure-lateral-movement

What problem does it solve?

Lateral movement in cloud identities enables attackers to pivot across tenants and access across-cloud services. This skill helps security teams detect such activity by correlating Microsoft Graph API audit logs, Azure sign-in events, and risk signals to surface suspicious patterns and privilege escalation attempts.

Core Features & Use Cases

• Correlates directory audits, sign-ins, and risk events to surface cross-tenant pivots and credential abuse.
• Detects OAuth consent abuse, service principal credential changes, cross-tenant sign-ins, and token replay patterns.
• Supports threat hunting and incident response in Azure environments with multi-tenant setups.

Quick Start

Configure Azure AD and Graph API integration, then run the agent to ingest logs and generate a findings report.