GraphRunner Detection in Azure Environments

Lacey Cochrane@NullVectorX

•updated Mar 12, 2026•17•1•332

This rule detects potential GraphRunner activity in Azure environments by identifying suspicious authentication attempts to Microsoft Graph using the 'deviceCode' authentication protocol, combined with specific user agent strings associated with the GraphRunner tool. It categorizes detections into high confidence (both device code and suspicious user agent), device code authentication only, or suspicious user agent only.