Azure user invited an external user

azure

Classification:

attack

Tactic:

TA0003-persistence

Set up the azure integration.

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when an invitation is sent to an external user.

Strategy

Monitor Azure Active Directory Audit logs and detect when any @evt.name is equal to Invite external user and the @evt.outcome is equal to success.

Triage and response

Review and determine if the invitation and its recipient are valid.