Threat video1:00
Key Eater Entra ID App Secret Theft: Detection & IOCs
Key Eater abuses stolen Entra app secrets to reach 27 organizations via MSPs, with 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for Key Eater Entra ID App Secret Theft: Detection & IOCs →
Chapters
- 0:00The hook27 organizations breached by stolen credentials.
- 0:05The storyOn November first, stolen credentials logged in.
- 0:12Attack pathSpray and stolen secrets gained direct access.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise4 indicators to hunt: 3 IPs and 1 hosting.
- 0:38MITRE ATT&CK techniques10 ATT&CK techniques, from resource development to collection.
- 0:43Remediation5 steps now: Investigate successful AND failed service-principal sign-ins.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0027 organizations breached by stolen credentials.
0:05On November first, stolen credentials logged in.
0:08Days later, they swept customer tenants.
0:12Spray and stolen secrets gained direct access.
0:15Tokens chained to Microsoft Graph, SharePoint, Exchange.
0:19They swept fifteen customer MSP tenants.
0:22Conditional Access blocked token replay.
0:28No threat actor is attributed. Confidence: low.
0:334 indicators to hunt: 3 IPs and 1 hosting.
0:3810 ATT&CK techniques, from resource development to collection.
0:435 steps now: Investigate successful AND failed service-principal sign-ins.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.