Threat video1:00
BluePhishing Entra Agent ID Consent: Detection & IOCs
A consent phish plants a rogue Entra agent blueprint in your tenant; 9 detection rules, 11 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for BluePhishing Entra Agent ID Consent: Detection & IOCs →
Chapters
- 0:00The hookLab researchers reproduced AI agent consent phishing.
- 0:04The storyProofpoint published a proof of concept.
- 0:12Attack pathResearchers reproduced a multi-tenant blueprint.
- 0:28AttributionNo threat actor: this was defensive research.
- 0:32Indicators of compromise2 indicators to hunt: 2 URLs.
- 0:38MITRE ATT&CK techniques11 ATT&CK techniques, from reconnaissance to lateral movement.
- 0:43Remediation5 steps now: Monitor Entra audit logs for 'Create an agent identity blueprint.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Lab researchers reproduced AI agent consent phishing.
0:05Proofpoint published a proof of concept.
0:07Microsoft was notified first. No in-the-wild activity.
0:12Researchers reproduced a multi-tenant blueprint.
0:16A consent link asked for approval.
0:18Then agent identities were created.
0:20A token then carried Graph access.
0:23Inherited permissions stay hidden from the portal.
0:28No threat actor: this was defensive research.
0:332 indicators to hunt: 2 URLs.
0:3811 ATT&CK techniques, from reconnaissance to lateral movement.
0:435 steps now: Monitor Entra audit logs for 'Create an agent identity blueprint.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.