Application-Only Credential Modification Preceded by Graph API Reconnaissance

Kaung Khant Ko@kaungkhantko

•updated today•0•0•2

Detects credential additions or updates (certificates/secrets) to applications or service principals performed by an application identity (app-only, no user present), where the actor application also performed Microsoft Graph activity prior to the credential change.