Loading story…
Splunk published attack simulation datasets showing two Microsoft Entra ID account-manipulation scenarios tied to MITRE ATT&CK T1098. In one case, an attacker changes an Azure AD guest account’s UserType from Guest to Member, removing the normal tenant-resource restrictions applied to guest identities and potentially expanding access for persistence. The dataset is based on Azure Audit logs and includes a benign user profile update that changes MobilePhone without modifying UserType, allowing defenders to test detection specificity.
A second dataset models persistence through T1098.001 by adding a federated identity credential to an Entra ID service principal. The simulated change establishes trust with an external GitHub Actions OIDC issuer and repository outside the tenant’s control, creating a path for unauthorized workload authentication. That dataset also includes a benign service principal update that changes only DisplayName, helping analysts distinguish malicious federated credential additions from routine administrative activity during replay and validation in Splunk environments.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk Research published an attack simulation dataset in which an Azure Entra ID guest account has its UserType changed from Guest to Member, removing normal guest tenant-resource restrictions. The Azure Audit log dataset is intended for replay or manual import into Splunk Attack Range environments and maps to MITRE ATT&CK T1098.
Splunk Research published an attack simulation dataset showing a federated identity credential added to a Microsoft Entra ID service principal, configured to an external GitHub Actions OIDC issuer and repository not controlled by the tenant. The dataset is presented as Azure Audit log data for testing and replay and maps to MITRE ATT&CK T1098.001.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New research warns that Microsoft Entra Agent ID can significantly widen the impact of a single credential compromise because authentication is anchored to an **agent blueprint** while privileges can be distributed across many child agent identities. Security researchers found that one blueprint principal can authenticate up to 250 agent identities per tenant, optionally span multiple tenants, and inherit a mix of service principal permissions, user-like capabilities, Entra role assignments, and delegated permissions. Datadog and Compass Security both reported that this design creates a larger blast radius than traditional Entra applications, especially when third-party or multitenant blueprints are used, because the publishing tenant controls the credential material trusted by consuming tenants. Researchers also demonstrated practical abuse paths. Compass Security showed that attackers who gain blueprint ownership or credential-management access could add credentials, create child agent identities through the `AgentIdentity.CreateAsManager` role claim, and potentially escalate privileges up to **Global Administrator**; it also described consent-phishing with a foreign multitenant blueprint to inherit permissions such as `Application.ReadUpdate.All`. Separately, Red Canary documented a suspicious non-interactive Microsoft Graph sign-in tied to an assistive agent, where the application `Agent001` authenticated with a federated identity credential, satisfied MFA via token claims rather than user interaction, and requested broad scopes including `Group.Read.All`, `Mail.ReadWrite`, `Mail.Send`, `MailboxSettings.ReadWrite`, and `User.Read`, underscoring how Agent ID workflows can blur the line between application and user access.
Jul 1, 2026
Proofpoint reported that attackers are increasingly abusing **OAuth client ID spoofing** against Microsoft Entra ID to enumerate accounts and validate credentials without registering a legitimate OAuth application. The activity relies on Resource Owner Password Credentials (ROPC) authentication requests that use spoofed or random `client_id` values, allowing attackers to distinguish invalid usernames, valid usernames with incorrect passwords, and in some cases valid username-password pairs based on Microsoft Entra `AADSTS` error responses. Proofpoint said it observed at least two large-scale campaigns, **UNK_pyreq2323** and **UNK_OutFlareAZ**, using different infrastructure, user agents, and client ID generation patterns, indicating the technique is being adopted by multiple threat actors. Microsoft’s published Entra error code behavior helps explain how responses such as `AADSTS700016` can leak authentication state, and defenders were urged to review Entra sign-in logs for blank or missing application names or IDs and to treat some apparent failed logins as possible signs of successful credential validation by an attacker.
Aug 19, 2026
Researchers reported that Microsoft Entra ID’s legacy WS-Trust autologon endpoint for Seamless SSO can be abused to conduct password-spraying attacks with reduced defensive visibility. Testing found the `usernamemixed` endpoint remained reachable for older Office 2013-era clients, did not appear to trigger expected Smart Lockout protections, and omitted failed attempts from standard Entra ID sign-in logs. The endpoint also returned distinct `AADSTS` error codes that let attackers distinguish invalid passwords from valid credentials that were later blocked by MFA or Conditional Access, enabling efficient credential validation without full account access. The activity aligns with ATT&CK techniques for **Password Spraying** and abuse of **Valid Accounts**, including default or legacy authentication paths that permit legitimate-looking logons once credentials are known. Defenders were advised to disable the WS-Trust `usernamemixed` endpoint, block legacy authentication through Conditional Access, monitor the Unified Audit Log for autologon requests, and use detections for repeated failed logons from a single IP across multiple users—similar to Okta analytics that flag more than five invalid authentication attempts from one source as suspicious spraying behavior.
Aug 12, 2026