2026 Critical Cloud Identity Detection: Cross-Tenant Access Settings Modified to Allow External Tenant
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings. This rule alerts on changes that allow external tenants to interact with the environment, such as enabling inbound/outbound trusts, automatic redemption, or trusting MFA claims, which can be leveraged to establish persistence or facilitate lateral movement between tenants.
YARA-L
