Indicator Release Notes

Indicators Release202507150942 Jul 15, 2025, 9:42 AM modified detection Disabled Account Assigned to Privileged Role Dormant Privileged User Empty Group Guest Account With a Privileged Role Missing MFA for Privileged Account Never Used Privileged User Privileged Account Naming Convention Privileged Entra Account Synchronized With AD (Hybrid) Single Member Group new Dormant Non-Privileged User Dormant Privileged User Empty Group Never Used Non-Privileged User Never Used Privileged User Single Member Group
Indicators Release202507070935 Jul 7, 2025, 9:35 AM modified detection Dangerous Application Permissions Affecting the Tenant Dangerous Delegated Permissions Affecting the Tenant new Privileged Custom Role
Indicators Release202506240832 Jun 24, 2025, 8:32 AM new Admin Consent Workflow for Applications Not Configured User With API Token
Indicators Release202506111610 Jun 11, 2025, 4:10 PM new Managed Devices Not Required for MFA Registration Password Expiration Enforced
Indicators Release202506041401 Jun 4, 2025, 2:01 PM new Weak Password Policy - Common Passwords Weak Password Policy - Lockout Threshold Weak Password Policy - Minimum Age Weak Password Policy - Minimum Length Weak Password Policy - Password History
Indicators Release202505121217 May 12, 2025, 12:17 PM new Authentication Methods Migration Not Complete Managed Devices Not Required for Authentication Users Allowed to Join Devices
Indicators Release202504150945 Apr 15, 2025, 9:45 AM new Dangerous Application Permissions Affecting Data Dangerous Delegated Permissions Affecting Data Risky Users Without Enforcement
Indicators Release202501131029 Jan 13, 2025, 10:29 AM new Dormant Non-Privileged User Dormant Privileged User Never Used Non-Privileged User Never Used Privileged User
Indicators Release202501101005 Jan 10, 2025, 10:05 AM new Ability of Standard Accounts to Register Applications Legacy Authentication Not Blocked MFA Not Required for a Privileged Role Show Additional Context in Microsoft Authenticator Notifications
Indicators Release202412121441 Dec 12, 2024, 2:41 PM new Dynamic Group Featuring an Exploitable Rule
Indicators Release202411251447 Nov 25, 2024, 2:47 PM new Dangerous Application Permissions Affecting the Tenant Dangerous Delegated Permissions Affecting the Tenant
Indicators Release202411071130 Nov 7, 2024, 11:30 AM new Dormant Device Entra Security Defaults Not Enabled Federated Domains List Federation Signing Certificates Mismatch Known Federated Domain Backdoor MFA Not Required for Risky Sign-ins Missing MFA for Non-Privileged Account Never Used Device Password Protection Not Enabled for On-Premises Environments Privileged Entra Account Synchronized With AD (Hybrid) Privileged Entra Account With Access To M365 Services Temporary Access Pass Feature Enabled Unrestricted User Consent for Applications Unusual Federation Signing Certificate Validity Period Unverified Domain
Indicators Release202409041620 Sep 4, 2024, 4:20 PM new Disabled Account Assigned to Privileged Role
Indicators Release202409031727 Sep 3, 2024, 5:27 PM new Conditional Access Policy Disables Continuous Access Evaluation
Indicators Release202408291505 Aug 29, 2024, 3:05 PM new First-Party Service Principal With Credentials
Indicators Release202408281039 Aug 28, 2024, 10:39 AM new High Number of Administrators
Indicators Release202405281050 May 28, 2024, 10:50 AM new Public M365 Group
Indicators Release202405221632 May 22, 2024, 4:32 PM new Missing MFA for Privileged Account
Indicators Release202405221022 May 22, 2024, 10:22 AM new Guest Accounts with Equal Access to Normal Accounts Unrestricted Guest Accounts
Indicators Release202404171632 Apr 17, 2024, 4:32 PM new Application Allowing Multi-Tenant Authentication
Indicators Release202404160821 Apr 16, 2024, 8:21 AM new Suspicious "Directory Synchronization Accounts" Role Assignment
Indicators Release202404111338 Apr 11, 2024, 1:38 PM new Privileged Account Naming Convention
Indicators Release202404101656 Apr 10, 2024, 4:56 PM new Single Member Group
Indicators Release202404101648 Apr 10, 2024, 4:48 PM new Empty Group
Indicators Release202403251434 Mar 25, 2024, 2:34 PM new Guest Account With a Privileged Role

Detections

Analytics

Indicator Release Notes

Indicators Release202507150942

modified detection

new

Indicators Release202507070935

modified detection

new

Indicators Release202506240832

new

Indicators Release202506111610

new

Indicators Release202506041401

new

Indicators Release202505121217

new

Indicators Release202504150945

new

Indicators Release202501131029

new

Indicators Release202501101005

new

Indicators Release202412121441

new

Indicators Release202411251447

new

Indicators Release202411071130

new

Indicators Release202409041620

new

Indicators Release202409031727

new

Indicators Release202408291505

new

Indicators Release202408281039

new

Indicators Release202405281050

new

Indicators Release202405221632

new

Indicators Release202405221022

new

Indicators Release202404171632

new

Indicators Release202404160821

new

Indicators Release202404111338

new

Indicators Release202404101656

new

Indicators Release202404101648

new

Indicators Release202403251434

new