T1098.003: Storm-3119 App-Only Password Reset, License Assignment and Role Grant

Tim Peck@timpeck

•updated yesterday•3•0•11

Detects a single application or service principal performing a password reset, a license assignment, and a privileged role grant within a one-hour window. This sequence matches Storm-3119 admin-panel abuse of a compromised tenant client secret through an app-only flow in Microsoft 365 or Entra ID.