Investigating suspicious AI workflows in Microsoft Entra Agent ID: Assistive agents
ID: 4975340d-384d-5ec4-a87b-fb9acd73431f
STIX ID: report--4975340d-384d-5ec4-a87b-fb9acd73431f
Feed Name: Red Canary
### Executive Summary: This file contains an Azure AD non-interactive sign-in log for App "Agent001" (AppId 8cd0a10f-0be8-413a-9bf2-f44bc568d1e4) showing federated credential usage by user Matt Graeber from IP 51.3.97.221 (Ashburn, VA); MFA was satisfied by a token claim and OAuth scopes show broad Graph permissions—no explicit malicious activity or indicators of compromise are present in the log.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.