Suspicious Entra ID Actor Token Abuse - Cross-Tenant Impersonation (CVE-2025-55241)
Detects potential abuse of Microsoft Actor tokens for cross-tenant impersonation attacks targeting Entra ID tenants. This rule identifies suspicious audit log entries that may indicate exploitation of CVE-2025-55241, a critical vulnerability in Azure AD Graph API that allowed attackers to impersonate any user across Entra ID tenants using malicious Actor tokens.
Microsoft Sentinel (KQL)
