detecting-azure-lateral-movement

Detect Azure AD lateral movement by correlating Microsoft Graph API audit logs, sign-in events, and risk events to surface suspicious cross-tenant pivots and credential abuse patterns.

Threat hunt for OAuth consent abuse, service principal credential changes, cross-tenant sign-ins, and token replay patterns to identify privilege escalation and token theft in Entra ID environments.

Yes, investigating Azure lateral movement requires Graph API permissions and log ingestion in a Log Analytics workspace to correlate directory audits, sign-ins, and risk events across multi-tenant environments.

Yes, the detection process delivers structured findings with MITRE technique mappings for identified lateral movement, privilege escalation, and token theft indicators to support incident investigation.

Investigate service principal abuse by correlating Graph API audit logs with Azure sign-in events to detect credential changes, cross-tenant pivots, and token replay patterns across multi-tenant Entra ID environments.

Detection relies on continuous Graph API log ingestion in a Log Analytics workspace and proper permissions; insufficient log retention or missing audit events can prevent accurate correlation of lateral movement patterns.