Microsoft-Analyzer-Suite v1.6.0

[1.6.0] - 2025-07-24

Added

• EntraSignInLogs-Analyzer: UniqueTokenIdentifier
• EntraSignInLogs-Analyzer: IncomingTokenType
• EntraSignInLogs-Analyzer: SignInTokenProtectionStatus
• EntraSignInLogs-Analyzer: SignInTokenProtectionStatus (Stats)
• EntraSignInLogs-Analyzer: Suspicious Sign-Ins via Visual Studio Code
• EntraSignInLogs-Analyzer: Suspicious ADRS Token Request(s) by Microsoft Authentication Broker
• EntraAuditLogs-Analyzer: Suspicious Cloud Device Registration
• UAL-Analyzer: ActorInfoString
• UAL-Analyzer: ActorInfoString (Stats)
• Config.ps1 → Config.json

Fig 1: OAuth Phishing via Visual Studio Code Client (Emulation)

Fig 2: Visual Studio Code Phishing (Abusing Legitimate Microsoft Workflow)

Fig 3: Suspicious Sign-Ins via Visual Studio Code Client found

Fig 4: EntraSignInLogs-Analyzer (1)

Fig 5: EntraSignInLogs-Analyzer (2)

Fig 6: Suspicious Cloud Device Registration detected [T1098.005]

Fixed

• Minor fixes and improvements

References
https://www.elastic.co/security-labs/entra-id-oauth-phishing-detection
https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/