Azure user invited an external user

azure

Classification:

attack

Tactic:

TA0003-persistence

Set up the azure integration.

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when an invitation is sent to an external user.

Strategy

Monitor Azure Active Directory Audit logs and detect when any @evt.name is equal to Invite external user and the @evt.outcome is equal to success.

Triage and response

Review and determine if the invitation and its recipient are valid.