Blog Post

Microsoft Security Experts Blog
15 MIN READ

Investigating malicious OAuth applications using the Unified Audit Log

matthewzorich's avatar
matthewzorich
Icon for Microsoft rankMicrosoft
Dec 15, 2023
Abstract Supply chain attacks continue to evolve in sophistication with new TTPs emerging every few months. In this article we highlight some of the most recently observed TTPs and our recommendati...
Updated Dec 13, 2023
Version 1.0
microsoft detection and response team (dart)
microsoft incident response (ir)
adampra86's avatar
adampra86
Copper Contributor
Jan 17, 2024

matthewzorich Awesome stuff ! Quick quesyion. What if under Partner relationships - role authorization I see none assigned but while looking at the sign-in events I can results for cross tenant access types == service provider ? Also, not sure how DAP works with CAP, but wouldn't MFA be still enforced ?Thanks !