AiTM - Cross-Tenant Access Misconfiguration (T1098)
Identifies the threat actor modifying Azure AD Cross-Tenant Access Policies to allow B2B collaboration with external attacker-controlled tenants.
Microsoft Sentinel (KQL)
Identifies the threat actor modifying Azure AD Cross-Tenant Access Policies to allow B2B collaboration with external attacker-controlled tenants.
Already have an account?