| …

This write-up describes an investigation into attackers leveraging stolen application client secrets to sign into Microsoft Entra ID and access tenant resources; it highlights the risk of long-lived or forgotten application permissions and provides practical hunting guidance, including KQL queries searching EntraIdSignInEvents and EntraIdSpnSignInEvents for AADSTS7000215 (Invalid client secret) and AADSTS7000222 (Expired client secret), and advises analysts to review application permissions, source IPs, and related successful authentications.