Azure AD Graph Access with Suspicious User-Agent

Description

Identifies Azure AD Graph (graph.windows.net) requests originating from user-agent strings associated with offensive tooling, scripting libraries, or generic HTTP clients. First-party Microsoft components calling AAD Graph identify with specific user agents such as "Microsoft Azure Graph Client Library", "Microsoft ADO.NET Data Services", or "Microsoft.OData.Client". Anything outside that recognised set is either a developer prototyping against the legacy API or an enumeration tool walking the directory.

Query · esql

from logs-azure.aadgraphactivitylogs-* metadata _id, _version, _index

| where data_stream.dataset == "azure.aadgraphactivitylogs"
    and azure.aadgraphactivitylogs.properties.actor_type == "User"
    and user_agent.original is not null
| eval Esql.ua_lower = to_lower(user_agent.original)
| where Esql.ua_lower like "*fasthttp*"
    or Esql.ua_lower like "*aiohttp*"
    or Esql.ua_lower like "*hound*"
    or Esql.ua_lower like "*aadinternals*"
    or Esql.ua_lower like "*go-http-client*"
    or Esql.ua_lower like "python*"
    or Esql.ua_lower like "*curl/*"
    or Esql.ua_lower like "*okhttp*"
    or Esql.ua_lower like "*axios*"
    or Esql.ua_lower like "*node-fetch*"
    or Esql.ua_lower like "*go-resty*"
    or Esql.ua_lower like "*bav2ropc*"
    or Esql.ua_lower like "*undici*"
| keep
    _id,
    _version,
    _index,
    @timestamp,
    user.id,
    source.ip,
    source.as.organization.name,
    user_agent.original,
    azure.aadgraphactivitylogs.properties.app_id,
    azure.aadgraphactivitylogs.properties.api_version,
    url.path,
    http.response.status_code,
    azure.tenant_id,
    Esql.ua_lower

Investigation fields

Pivot points the source recommends for triage.

  • user.id
  • source.ip
  • source.as.organization.name
  • user_agent.original
  • azure.aadgraphactivitylogs.properties.app_id
  • azure.aadgraphactivitylogs.properties.api_version
  • url.path
  • http.response.status_code
  • azure.tenant_id

Implementation guide

Requires Azure AD Graph Activity Logs ingested into logs-azure.aadgraphactivitylogs-* via the Elastic Azure integration (Azure Event Hub). Enable the AzureADGraphActivityLogs diagnostic-settings category on Entra ID.

Known false positives

  • Developer activity prototyping against AAD Graph from a workstation may match. Validate via the calling `azure.aadgraphactivitylogs.properties.app_id` and the signed-in user; legitimate developer use is rare in production tenants since Microsoft has been steering callers off AAD Graph for years.
  • Authorized red team or penetration test activity using ROADrecon, ROADtools, AADInternalsor similar tooling can match. Add exceptions on the source IP, signed-in user, or app ID after validation.

Analyst notes

Investigating Azure AD Graph Access with Suspicious User-Agent

Azure AD Graph (graph.windows.net) is the legacy directory REST API that Microsoft has been retiring for years. Legitimate first-party traffic against it is dominated by a small set of recognisable user agents (Microsoft.OData.Client, Microsoft Azure Graph Client Library, Microsoft ADO.NET Data Services, the Azure portal with a Chrome user agent, and an empty-UA tail from first-party AppIds). Traffic identifying as Python, aiohttp, curl, Go-http-client, or any of the *hound enumeration families is almost always either a developer prototype or adversary tooling. This rule flags any such request even at a single event, because tooling samples for AAD Graph are inherently low-volume in normal tenants.

Possible investigation steps

  • Confirm the matching user agent.
    • user_agent.original (e.g., aiohttp, AADInternals, curl, bav2ropc).
  • Identify the caller and the calling client.
    • user.id for the caller, azure.aadgraphactivitylogs.properties.app_id for the OAuth client.
  • Review which directory object types were touched.
    • url.path (e.g., /users, /policies, /servicePrincipals).
  • Check the success / failure pattern.
    • http.response.status_code. Many 4xx responses suggest permission probing.
  • Cross-reference with the API version.
    • azure.aadgraphactivitylogs.properties.api_version. A non-Microsoft UA combined with 1.6-internal or 1.61-internal is a stronger signal of offensive tooling.
  • Pivot to sign-in logs (logs-azure.signinlogs-*) for the same user / source IP to understand how the token was obtained.
  • Confirm the activity is not attributable to authorized testing (red team engagement, penetration test, internal tooling validation) before treating as malicious.

Response and remediation

  • Revoke refresh tokens and active sessions for the calling user.
    • POST /v1.0/users/{id}/revokeSignInSessions.
  • Temporarily disable the user if the alert is high-confidence or you need to halt further activity while investigation continues.
    • PATCH /v1.0/users/{id} with body {"accountEnabled": false}.
  • Check for device registrations created by the user during or around the burst window and remove rogue devices.
    • GET /v1.0/users/{id}/registeredDevices and GET /v1.0/users/{id}/ownedDevices, then DELETE /v1.0/devices/{deviceObjectId}.
    • Do this BEFORE session revocation: device-bound PRTs survive revokeSignInSessions.
  • If the calling application has no legitimate AAD Graph dependency, block further use by that app.
    • PATCH /beta/applications/{id} with body {"authenticationBehaviors": {"blockAzureADGraphAccess": true}}.
    • This property lives on the Graph beta endpoint, not v1.0.
  • Apply Conditional Access targeting the AAD Graph audience for the affected user population.
Raw source Azure AD Graph Access with Suspicious User-Agent · Elastic TOML
Esc
Published by elastic/detection-rules ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[metadata]
creation_date = "2026/05/20"
integration = ["azure"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Identifies Azure AD Graph (graph.windows.net) requests originating from user-agent strings associated with offensive
tooling, scripting libraries, or generic HTTP clients. First-party Microsoft components calling AAD Graph identify with
specific user agents such as "Microsoft Azure Graph Client Library", "Microsoft ADO.NET Data Services", or
"Microsoft.OData.Client". Anything outside that recognised set is either a developer prototyping against the legacy API
or an enumeration tool walking the directory.
"""
false_positives = [
    """
    Developer activity prototyping against AAD Graph from a workstation may match. Validate via the calling
    `azure.aadgraphactivitylogs.properties.app_id` and the signed-in user; legitimate developer use is rare in
    production tenants since Microsoft has been steering callers off AAD Graph for years.
    """,
    """
    Authorized red team or penetration test activity using ROADrecon, ROADtools, AADInternalsor similar tooling can match. Add
    exceptions on the source IP, signed-in user, or app ID after validation.
    """,

]
from = "now-10m"
interval = "9m"
language = "esql"
license = "Elastic License v2"
name = "Azure AD Graph Access with Suspicious User-Agent"
note = """## Triage and analysis

### Investigating Azure AD Graph Access with Suspicious User-Agent

Azure AD Graph (graph.windows.net) is the legacy directory REST API that Microsoft has been retiring for years.
Legitimate first-party traffic against it is dominated by a small set of recognisable user agents (`Microsoft.OData.Client`,
`Microsoft Azure Graph Client Library`, `Microsoft ADO.NET Data Services`, the Azure portal with a Chrome user agent,
and an empty-UA tail from first-party AppIds). Traffic identifying as Python, aiohttp, curl, Go-http-client, or any
of the `*hound` enumeration families is almost always either a developer prototype or adversary tooling. This rule
flags any such request even at a single event, because tooling samples for AAD Graph are inherently low-volume in
normal tenants.

### Possible investigation steps

- Confirm the matching user agent.
    - `user_agent.original` (e.g., `aiohttp`, `AADInternals`, `curl`, `bav2ropc`).
- Identify the caller and the calling client.
    - `user.id` for the caller, `azure.aadgraphactivitylogs.properties.app_id` for the OAuth client.
- Review which directory object types were touched.
    - `url.path` (e.g., `/users`, `/policies`, `/servicePrincipals`).
- Check the success / failure pattern.
    - `http.response.status_code`. Many 4xx responses suggest permission probing.
- Cross-reference with the API version.
    - `azure.aadgraphactivitylogs.properties.api_version`. A non-Microsoft UA combined with `1.6-internal` or `1.61-internal` is a stronger signal of offensive tooling.
- Pivot to sign-in logs (`logs-azure.signinlogs-*`) for the same user / source IP to understand how the token was obtained.
- Confirm the activity is not attributable to authorized testing (red team engagement, penetration test, internal tooling validation) before treating as malicious.

### Response and remediation

- Revoke refresh tokens and active sessions for the calling user.
    - `POST /v1.0/users/{id}/revokeSignInSessions`.
- Temporarily disable the user if the alert is high-confidence or you need to halt further activity while investigation continues.
    - `PATCH /v1.0/users/{id}` with body `{"accountEnabled": false}`.
- Check for device registrations created by the user during or around the burst window and remove rogue devices.
    - `GET /v1.0/users/{id}/registeredDevices` and `GET /v1.0/users/{id}/ownedDevices`, then `DELETE /v1.0/devices/{deviceObjectId}`.
    - Do this BEFORE session revocation: device-bound PRTs survive `revokeSignInSessions`.
- If the calling application has no legitimate AAD Graph dependency, block further use by that app.
    - `PATCH /beta/applications/{id}` with body `{"authenticationBehaviors": {"blockAzureADGraphAccess": true}}`.
    - This property lives on the Graph beta endpoint, not v1.0.
- Apply Conditional Access targeting the AAD Graph audience for the affected user population.
"""
references = [
    "https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview",
    "https://github.com/dirkjanm/ROADtools",
    "https://www.sophos.com/en-us/research/tampering-with-conditional-access-policies-using-azure-ad-graph-api",
    "https://github.com/gerenios/aadinternals",
]
risk_score = 73
rule_id = "3aec394d-ed2a-4f3e-8ed3-4a2adea39f05"
setup = """#### Azure AD Graph Activity Logs
Requires Azure AD Graph Activity Logs ingested into `logs-azure.aadgraphactivitylogs-*` via the Elastic Azure
integration (Azure Event Hub). Enable the `AzureADGraphActivityLogs` diagnostic-settings category on Entra ID.
"""
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: Azure",
    "Data Source: Azure AD Graph",
    "Data Source: Azure AD Graph Activity Logs",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-azure.aadgraphactivitylogs-* metadata _id, _version, _index

| where data_stream.dataset == "azure.aadgraphactivitylogs"
    and azure.aadgraphactivitylogs.properties.actor_type == "User"
    and user_agent.original is not null
| eval Esql.ua_lower = to_lower(user_agent.original)
| where Esql.ua_lower like "*fasthttp*"
    or Esql.ua_lower like "*aiohttp*"
    or Esql.ua_lower like "*hound*"
    or Esql.ua_lower like "*aadinternals*"
    or Esql.ua_lower like "*go-http-client*"
    or Esql.ua_lower like "python*"
    or Esql.ua_lower like "*curl/*"
    or Esql.ua_lower like "*okhttp*"
    or Esql.ua_lower like "*axios*"
    or Esql.ua_lower like "*node-fetch*"
    or Esql.ua_lower like "*go-resty*"
    or Esql.ua_lower like "*bav2ropc*"
    or Esql.ua_lower like "*undici*"
| keep
    _id,
    _version,
    _index,
    @timestamp,
    user.id,
    source.ip,
    source.as.organization.name,
    user_agent.original,
    azure.aadgraphactivitylogs.properties.app_id,
    azure.aadgraphactivitylogs.properties.api_version,
    url.path,
    http.response.status_code,
    azure.tenant_id,
    Esql.ua_lower
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"
[[rule.threat.technique.subtechnique]]
id = "T1069.003"
name = "Cloud Groups"
reference = "https://attack.mitre.org/techniques/T1069/003/"


[[rule.threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[rule.threat.technique.subtechnique]]
id = "T1087.004"
name = "Cloud Account"
reference = "https://attack.mitre.org/techniques/T1087/004/"


[[rule.threat.technique]]
id = "T1526"
name = "Cloud Service Discovery"
reference = "https://attack.mitre.org/techniques/T1526/"


[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule.investigation_fields]
field_names = [
    "user.id",
    "source.ip",
    "source.as.organization.name",
    "user_agent.original",
    "azure.aadgraphactivitylogs.properties.app_id",
    "azure.aadgraphactivitylogs.properties.api_version",
    "url.path",
    "http.response.status_code",
    "azure.tenant_id",
]

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.