Midnight Blizzard: Malicious Entra App Registration and Service Principal Abuse
A nation-state-style identity-plane intrusion that lives entirely in Microsoft Entra ID and Exchange Online. A low-and-slow password spray across rotating residential-proxy IPs lands on a legacy, no-MFA test account; from there the actor pivots into the application layer, creates a rogue user, registers a new malicious application and service principal, grants it the Office 365 Exchange Online full_access_as_app role plus EWS.AccessAsUser.All, adds a client secret for durable app-only access, and reads corporate mailboxes over Exchange Web Services with no user sign-in. Work the Entra sign-in audit, the application and service-principal lifecycle and role-assignment events, the credential change, and the EWS mailbox operations to reconstruct the chain and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Identify the foothold account
35One account authenticated successfully from an external IP the tenant does not recognize, after a run of failures across rotating addresses. Identify it.
Classify the initial-access technique
30Map the way the actor got into the foothold account to its MITRE ATT&CK sub-technique.
Find the malicious application
40The actor's durable foothold is not the password. Identify the application (client) ID of the new app it registered.
Name the role that opened every mailbox
40One app role assignment turned an ordinary application into tenant-wide mailbox access. Identify the Exchange Online application role the actor granted.
Find the durable-persistence credential
30The actor made the application's access survive without any user. Identify the credential it added to the service principal.
Confirm the mailbox that was collected
35The application read corporate mail over Exchange Web Services. Identify the first mailbox it collected.
Classify the mailbox-collection technique
30Map the way the actor read the mailboxes to its MITRE ATT&CK sub-technique.
8 tasks · 240 points total
Training Tools
Cloud Console
Cloud infrastructure logs
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with Cloud concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allTRITON: Safety System Sabotage at a Petrochemical Plant
A nation-state-grade ICS intrusion that reaches the deepest protective layer of a petrochemical plant. An attacker reuses remote access to pivot from the DCS network onto a dual-homed Schneider Triconex SIS engineering workstation, transfers the TRITON attack framework (an executable masquerading as the legitimate Triconex Trilog viewer plus a bundled library and two controller payloads), and uses the proprietary TriStation protocol to reprogram a safety controller, until a failed validation check trips an unplanned emergency shutdown. Reconstruct the kill chain from SIEM, endpoint XDR, and firewall telemetry, and classify the ICS impact techniques.
OneClik: ClickOnce + AppDomainManager Injection with ETW Patching and AWS-Hidden C2
A ClickOnce-delivered intrusion at an oil-and-gas operator that mirrors nation-state tradecraft. A spearphishing link served a Microsoft ClickOnce deployment that ran under the trusted dfsvc.exe, sideloaded a signed binary whose tampered .config used .NET AppDomainManager hijacking to load an attacker assembly at CLR startup, patched Event Tracing for Windows to blind the sensor, ran anti-debugging checks, and injected a Golang backdoor (RunnerBeacon) that hid its C2 behind AWS CloudFront and API Gateway. Reconstruct the chain from email, endpoint XDR, and cloud audit telemetry, and classify the key ATT&CK techniques.
Storm-2949: Azure VM Run Command, VMAccess Backdoor, and Key Vault Secret Dump
A hands-on-keyboard intrusion that turned one compromised cloud identity into control over an entire Azure estate. After seizing a finance user's account through self-service password reset abuse and attacker-owned MFA, the operator enumerated the tenant, escalated with an RBAC role assignment, harvested App Service publishing profiles, rewrote a Key Vault access policy and dumped every secret in four minutes, stole storage keys, and finished on a production VM using the VMAccess extension to mint a backdoor admin and Run Command to disable Defender and install ScreenConnect. Reconstruct the kill chain from the Azure cloud audit trail and the VM's endpoint XDR telemetry, and classify the key ATT&CK techniques.