Murky Panda Suspicious Entra Id Sp Activity

Tim Peck@timpeck

•updated Aug 22, 2025•3•4•90

Detects when new credentials are added to an Entra ID Service Principal, followed by a successful login from that principal within a short time frame. This pattern is consistent with MURKY PANDA TTPs for lateral movement and persistence in cloud environments.