Storm-3119 App-Only Tenant Takeover Sequence

Tim Peck@timpeck

•updated 12 days ago•7•0•24

Detects a potential app-only tenant-takeover sequence associated with Storm-3119 (YAM Store), where a single service principal performs an administrative password reset, a license assignment, and a privileged role grant within a one-hour window.