Microsoft Graph Request User Impersonation by Unusual Client

Last updated 22 days ago on 2025-12-10

Created 8 months ago on 2025-04-23

About

This New Terms rule focuses on the first occurrence of a client application ID (azure.graphactivitylogs.properties.app_id) making a request to Microsoft Graph API for a specific tenant ID (azure.tenant_id) and user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id). This rule may helps identify unauthorized access or actions performed by compromised accounts. Advesaries may succesfully compromise a user's credentials and use the Microsoft Graph API to access resources or perform actions on behalf of the user.

Tags

Domain: CloudData Source: AzureData Source: Microsoft GraphData Source: Microsoft Graph Activity LogsUse Case: Identity and Access AuditTactic: Initial AccessLanguage: kuery

Severity

low

Risk Score

MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Valid Accounts (T1078)(external, opens in a new tab or window)

Credential Access (TA0006)(external, opens in a new tab or window)

↳ Steal Application Access Token (T1528)(external, opens in a new tab or window)

False Positive Examples

Users legitimately accessing Microsoft Graph API using the specified client application ID and tenant ID. This may include authorized applications or services that interact with Microsoft Graph on behalf of users. Authorized third-party applications or services that use the specified client application ID to access Microsoft Graph API resources for legitimate purposes. Administrative or automated tasks that involve accessing Microsoft Graph API using the specified client application ID and tenant ID, such as provisioning or managing resources.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-azure.graphactivitylogs-*
Related Integrations: azure(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗event.dataset: "azure.graphactivitylogs"
    and event.type: "access"
    and azure.graphactivitylogs.properties.c_idtyp: "user"
    and azure.graphactivitylogs.properties.client_auth_method: 0
    and http.response.status_code: 200
    and url.domain: "graph.microsoft.com"

Install detection rules in Elastic Security

Detect Microsoft Graph Request User Impersonation by Unusual Client in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).