Hunting in Cloud Identity Logs

Try it out loud first. Then check yourself:

1. Token theft: a session used from a new IP or device right after a sign-in elsewhere, often with no new MFA prompt.
2. Persistence: new MFA methods, app registrations or service principal credentials, OAuth consents, and mailbox forwarding rules.
3. Defense changes: Conditional Access policies edited, legacy authentication used, or admin roles assigned outside change windows.
4. Baseline per user and per app; the hard part is telling travel, VPNs and mobile networks apart from attackers.

If the interviewer pushes back

• An attacker added a credential to an existing app registration instead of creating a new one. Which log event shows it, and why is it easy to miss?

Go deeper

• attack.mitre.org/techniques/T1550/001/
• attack.mitre.org/techniques/T1098/001/