Techniques
Sample rules
Entra ID Actor Token User Impersonation Abuse
- source: elastic
- technicques:
- T1078
- T1548
Description
Identifies potential abuse of actor tokens in Microsoft Entra ID audit logs. Actor tokens are undocumented backend mechanisms used by Microsoft for service-to-service (S2S) operations, allowing services to perform actions on behalf of users. These tokens appear in logs with the service’s display name but the impersonated user’s UPN. While some legitimate Microsoft operations use actor tokens, unexpected usage may indicate exploitation of CVE-2025-55241, which allowed unauthorized access to Azure AD Graph API across tenants before being patched by Microsoft.
Detection logic
from logs-azure.auditlogs-* metadata _id, _version, _index
| where azure.auditlogs.properties.initiated_by.user.displayName in (
"Office 365 Exchange Online",
"Skype for Business Online",
"Dataverse",
"Office 365 SharePoint Online",
"Microsoft Dynamics ERP"
) and
not azure.auditlogs.operation_name like "*group*" and
azure.auditlogs.operation_name != "Set directory feature on tenant"
and azure.auditlogs.properties.initiated_by.user.userPrincipalName rlike ".+@[A-Za-z0-9.]+\\.[A-Za-z]{2,}"
| keep
_id,
@timestamp,
azure.*,
client.*,
event.*,
source.*