Payroll Pirate: Graph API Recon via Residential Proxy ASN Switch
This rule monitors Microsoft Entra ID (Azure AD) sign-ins for indicators associated with the 'Payroll Pirate' campaign. It identifies non-interactive OAuth/token-based authentication requests originating from residential Internet Service Provider (ISP) ASNs using devices marked as unmanaged. It further elevates risk by detecting impossible travel (same user accessing from multiple IPs in a short window) and the use of specific browser User-Agent strings (Firefox or Axios) characteristic of the threat actor's tooling.
Splunk (SPL)
