Unexpected Microsoft cloud activity from AADInternals default user agent
Description
AlphaSOC detected Microsoft Entra ID or Microsoft 365 activity with a user agent
containing AADInternals. AADInternals is a PowerShell toolkit used for cloud
administration and security testing, with capabilities that can also support
token theft, tenant reconnaissance, and persistence. Unauthorized use may
indicate an attacker operating with a compromised identity.
The detection identifies the tool by its default user agent, which can be changed. Habitual activity from the same identity may be suppressed, while activity from an unexpected source ASN still triggers an alert.
Impact
Unauthorized AADInternals use may allow an attacker to enumerate accounts, permissions, and services, obtain access tokens, or make changes that preserve access to the tenant. The available actions depend on the identity's permissions. The user agent alone does not establish which tool capabilities were used.
Severity
| Severity | Condition |
|---|---|
Medium | Activity with the AADInternals default user agent |
High | AADInternals activity from an unexpected source ASN |
Investigation and Remediation
Review the associated Entra or Microsoft 365 logs to identify the acting identity, source IP, ASN, user agent, and operations performed. Confirm whether the activity was part of authorized administration or a security assessment. Review related sign-ins, token use, permission changes, and federation changes.
If unauthorized, revoke affected sessions and tokens, reset compromised credentials, and remove any malicious access or configuration changes. Investigate other activity by the identity to determine the extent of the compromise.
Known False Positives
- Authorized red-team assessments or administrative troubleshooting using AADInternals