Storm-2372 On-Prem Synced Privileged Account Role Assignment or OAuth Consent

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

Detects a suspicious pattern where a highly privileged on-premises synchronized user account signs into Azure Active Directory (Entra ID) and immediately performs sensitive administrative actions (role assignment or OAuth application consent grant) within a 30-minute window. This behavior is indicative of credential abuse by the Storm-2372 actor to escalate privileges within a tenant.