↑↓ move ↵ open esc close Searches the full text of every issue.

SOC Weekly Brief The week in the Microsoft security stack, distilled

← Home

Week 37 · 14 min read

September 7 – September 14, 2026

Act by

  • 14 Sep 2026 — today, connectors and tables that depend on the legacy HTTP Data Collector API stop being eligible for incident support in Microsoft Sentinel. Ingestion is not switched off at a stroke, but anything still on that path may see ingestion issues and Microsoft will not take an incident on it. The things to check are custom scripts or applications writing straight into a workspace, Azure Functions-based custom connectors, classic custom log tables (marked type: Classic), and any Content Hub connector whose description still mentions the HTTP Data Collector API. The two supported destinations are a Content Hub connector version labelled via Codeless Connector Framework, or the Azure Monitor Logs Ingestion API for your own pipelines. Budget for the tail: a CCF migration changes table names and schemas, so analytics rules, hunting queries, workbooks, playbooks and parsers pointing at the old Azure Function tables all need updating after the data starts flowing. (Microsoft Security Community Blog)

  • 11 Oct 2026 — the Machines should have a vulnerability assessment solution recommendation is deprecated in Microsoft Defender for Cloud, announced 10 September as part of the move from grouped to individual recommendations. If that recommendation is wired into a compliance report, an exemption, a governance rule or a workflow automation, those break quietly when it disappears rather than failing loudly. Rebuild against the individual server vulnerability assessment recommendations before the date. (Microsoft Defender for Cloud release notes)

  • 10 Dec 2026 — support ends for Azure Linux with OS Guard in Azure Kubernetes Service, with Azure Container Linux as the replacement. From that date you cannot create new OS Guard node pools, AKS stops producing node images for them, and existing node pools stop receiving security patches — the last part is the one that matters, because a node pool running a hardened OS image that no longer gets patches is worse than the ordinary image that does. On 10 March 2027 the images are removed outright, after which reimage, redeploy and scaling operations fail on affected node pools. Migration is either an in-place node image upgrade to Azure Container Linux or a new node pool plus workload validation and cutover. (Azure Updates)

What changed

Microsoft Threat Intelligence published a teardown on 9 September of a passkey-themed social engineering campaign, and it is the item to walk your tier-1 analysts through this week. The pretext is a phone call or SMS from IT saying the user's passkey or MFA enrolment needs updating; the link goes to a convincing Microsoft sign-in clone, and the actual credential capture is either adversary-in-the-middle phishing against the OfficeHome application or device code flow phishing where the user is talked into authorising the attacker's device. A third observed pattern used credentials compromised earlier with MFA methods the attacker had already registered. What makes this worth briefing is what happens after the sign-in rather than the lure. The attacker registers their own authentication method — a phone number, an authenticator app, or a software OTP token — which converts a stolen session into durable access, then moves to Microsoft Graph and enumerates systematically: directory users and groups, privileged role assignments, MFA registration state, application consent grants and OAuth mappings, SharePoint and OneDrive repositories through search and delta and pagination, then mailbox folders and attachment metadata. Collection runs through the SharePoint, OneDrive and Exchange Online REST APIs at a deliberately throttled pace, under roughly a thousand files an hour, to sit inside normal usage. Microsoft attributes initial access to several actors including Storm-3121, whose campaigns feed ShinyHunters and Falcon extortion operations, and Storm-3032, a BlackFile splinter now operating as Helix. The phishing domains cluster around passkey, key-sync and SSO themes — passkeyhelpdesk[.]com, setupmypasskey[.]com, keysyncos[.]com, oskeysync[.]com, integratedsso[.]com, oktasession[.]com among them — often carry the target organisation's name as a subdomain, are registered through Nicenic, and go live within hours of registration, so blocklists will always be behind. Defender XDR alerts to watch are the MFA registration family, including Malicious registration of a device with strong MFA and Suspicious registration of new Authenticator MFA method, plus Suspicious Entra Graph API query observed and Automated mass SharePoint/OneDrive file access via python-httpx. The post ships seven hunting queries across CloudAppEvents and GraphAPIAuditEvents, including one that flags a single actor and IP touching three or more reconnaissance categories inside thirty minutes. Three controls are worth pushing off the back of it: phishing-resistant MFA through Conditional Access, security info registration gated on a managed device and a named location and blocked at high sign-in risk, and device code flow disabled except where a documented business need exists. If you contain one of these, removing the attacker-registered authentication method is not optional cleanup — leave it and the eviction fails. (Microsoft Security Blog)

September's Patch Tuesday, released 8 September, is the largest Microsoft has ever shipped: 977 CVEs carrying a Microsoft exploitability assessment, 114 of them rated Critical and 58 marked Exploitation More Likely. Two were already being exploited when the updates landed, and neither had been publicly disclosed beforehand. CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call rated 7.8; Microsoft's own FAQ describes the exploitation path as code running in a low-privilege AppContainer escaping the sandbox and reaching SYSTEM with no user interaction, which is exactly the second half of a browser or document exploit chain. CVE-2026-81963 is a link-following flaw in the Windows Update Stack, also 7.8, also local, also ending at SYSTEM. Both are ordinary Windows client and server patching rather than anything exotic, which makes fleet compliance the whole job. The volume otherwise should not panic anyone — a large share of the Critical entries are Exploitation Unlikely or Less Likely — but one is worth pulling out for anyone running Windows DNS: CVE-2026-69730 is a use-after-free in Windows DNS rated 9.8 and marked Exploitation More Likely, and the FAQ describes an unauthenticated attacker sending a crafted packet over the network with no authentication and no user interaction required. Domain controllers running the DNS role are the exposure. Separately, four cloud-service CVEs were published in the same release for transparency only, with no customer action: CVE-2026-83711 in Azure AD B2C at 10.0, CVE-2026-70352 in Azure AI Language at 10.0, CVE-2026-83941 in Entra ID at 9.9 and CVE-2026-62916 in Entra ID at 9.1, an authentication bypass over the network. All four are already mitigated on Microsoft's side, but they are useful to have on hand when someone forwards you a scanner report or a headline naming them. (MSRC Security Update Guide)

Microsoft published a survey on 10 September of AI-themed lures and what Defender does about them, and the campaign data is the part to keep. A ChatGPT-themed phishing kit built to harvest payment card details pushed up to 100,000 emails in a single day going after ChatGPT Plus billing information. A Claude-themed campaign used adversary-in-the-middle techniques to take credentials and access tokens. DeepSeek has been abused twice over — malvertising for a fake AI Windows plugin that delivered the Vidar stealer, and fraudulent installers distributed through GitHub. Storm-3075, an initial access broker, has been running AI-themed malvertising to deliver payloads on behalf of multiple downstream actors. The scale figures give useful context for a board conversation: Microsoft says attack disruption contains more than 81,000 compromised user accounts a month and disrupts more than 45,000 adversary-in-the-middle attacks a month, with one business email compromise case contained in four minutes. There are no new product features here and no alert names given, so treat it as confirmation that the AI brand is now simply the most effective phishing pretext going, and check that Safe Links and Safe Attachments policies actually cover every mailbox rather than a pilot group. (Microsoft Security Blog)

The same day brought an analysis of an executive impersonation and invoice fraud campaign that is worth handing to whoever owns your finance awareness training. Over a million emails went out between 3 and 5 August, 87.7 percent of them at US recipients, aimed at accounts payable in IT services, business advisory and consumer goods organisations. The construction is careful: CEO, CFO and President identities spoofed consistently across display name, reply-to and signature block; a fabricated ServiceNow Platform annual subscription invoice with branding, invoice number, dates and itemised lines requesting an ACH transfer of close to fifty thousand dollars; and a fake forwarded thread between the impersonated executives to manufacture prior approval. Lookalike domains included service-nowinc[.]com and domainlify[.]net. Microsoft assesses the content was generative-AI assisted based on excessive HTML comments, structured labelling, em dashes and a consistent template carrying personalised details — which is a useful tell for anyone writing detection logic, and a reminder that the old advice about spotting bad grammar is dead. The two authentic-looking failures to point at in training are that the fake thread carries no genuine email headers, and that the language discourages verification with lines like no need to copy me. Controls named are the usual and still correct set: SPF, DKIM and DMARC configured properly, enhanced filtering on any mail-flow connector fronting a third-party service, ZAP enabled, and automatic attack disruption switched on. (Microsoft Security Blog)

Defender for Identity's what's new page picked up three September items, all about getting sensors onto servers that have been awkward to cover. The v3.x sensor can now be activated on eligible domain controllers running Windows Server 2019 or later without onboarding them to Defender for Endpoint first, which removes the dependency that has held up MDI deployments in estates where the endpoint team and the identity team move at different speeds. Second, v3.x now supports eligible AD FS, AD CS and Microsoft Entra Connect servers that are not domain controllers — both in preview, with manual activation and automatic Windows event auditing supported, and neither automatic activation nor migration available yet. That is a real coverage gain: a certificate authority and a federation server are precisely the boxes an attacker wants and precisely the ones that historically sat outside identity monitoring. Third, the Onboarding and Sensors tabs on the identity On-premises settings page have merged into a single Sensor management tab listing installed sensors alongside servers eligible for activation, and automatic v3.x activation has moved to the Advanced features page — worth knowing before someone reports the setting as missing. (Microsoft Defender for Identity what's new)

User-bound user delegation SAS for Azure Storage reached general availability on 9 September across all public regions, and it closes a gap that has caused real incidents. A user delegation SAS is already the best of the SAS options — the delegator has to authenticate to Entra ID to mint one, the token traces back to them, and it can live at most seven days — but once issued it is still a bearer token that works for whoever holds it. The user-bound variant binds the token to a specific end-user identity, so a leaked SAS URL in a log, a ticket, a chat message or a browser history is not usable by the person who finds it. There is no additional cost beyond standard transaction charges. If your teams hand out SAS URLs for data access, this is the configuration to standardise on, and it gives you a defensible answer to the audit question about what happens when one of those links escapes. (Azure Updates)

KQL to try

An attachment-type hunt published on 10 September that pulls a curated extension blocklist into advanced hunting with externaldata rather than hard-coding one. The list is built from the CIS baseline, the Microsoft common attachment filter and a set of additional extensions, and the query joins EmailAttachmentInfo to EmailEvents so you can see delivery outcome alongside the attachment. The author's point is that you run this first to find out what your users actually receive, then feed the extensions that show up into the anti-malware policy's common attachment filter to quarantine or reject them — a commented-out line lets you exclude anything already blocked so you are only looking at what got through. (Unexpected Attachment Types in Emails — Jay Kerai)

//After Hunting consider adding attachment types in AntiMalware policy to quarantine/reject emails containing unexpected attachment types - the supplied list includes CIS baseline, the common attachment filter and some additional extension types.
let ExtensionList = externaldata(extension: string)[@"https://raw.githubusercontent.com/jkerai1/TLD-TABL-Block/refs/heads/main/FileExtensionsForAntiMalwarePolicy.csv"] with (format="csv", ignoreFirstRecord=True)
| extend extension = strcat(".",extension);
EmailAttachmentInfo
| where TimeGenerated > ago(90d)
| where FileExtension in(ExtensionList)
| join EmailEvents on NetworkMessageId
//| where DeliveryAction != @"Delivered" //if you wish to filter out what was already blocked

A Sentinel hunt from 9 September that looks for AD FS sign-ins where more than one IP address appears in the authentication flow, which is the signature of a proxy sitting between the user and the federation service. It reads the IP Addresses Involved in Auth Flow field out of AuthenticationProcessingDetails in ADFSSignInLogs, drops flows with a single address and any sourced from your known AD FS egress, then pivots by correlation ID into SigninLogs and AADNonInteractiveUserSignInLogs to establish what the resulting session went on to touch — apps accessed, resources reached, user agent, device detail. Trusted named locations are filtered out at the network-details step. It expects a watchlist named Activity-ExpectedSignificantActivity holding your expected AD FS addresses and trusted named locations, so populate that before the first run or everything looks anomalous. Given the adversary-in-the-middle activity in the passkey campaign above, this one is timely. (Multiple-Unexpected AD FS authentication flow — Jose Sebastián Canós)

let query_frequency = 5m;
let query_period = 2d;
let query_wait = 30m;
let _ExpectedADFSIPAddress = toscalar(
    _GetWatchlist("Activity-ExpectedSignificantActivity")
    | where Activity == "ADFSAuthenticationAddress"
    | summarize make_list(SourceAddress)
);
let _TrustedNamedLocations = toscalar(
    _GetWatchlist("Activity-ExpectedSignificantActivity")
    | where Activity == "TrustedNamedLocation"
    | summarize make_list(SourceResource)
);
ADFSSignInLogs
| where TimeGenerated between (ago(query_frequency + query_wait) .. ago(query_wait))
| where ResultType == 0 and isnotempty(IPAddress)
| mv-apply AuthenticationProcessingDetail = todynamic(AuthenticationProcessingDetails) on (
    where AuthenticationProcessingDetail has "IP Addresses Involved in Auth Flow"
    | extend IPAddressesInvolved = split(tostring(AuthenticationProcessingDetail["value"]), ",")
    )
| project-away AuthenticationProcessingDetail
| where not(array_length(IPAddressesInvolved) == 1) and not(IPAddress in (_ExpectedADFSIPAddress))
| summarize Auxiliar = arg_max(array_length(IPAddressesInvolved), IPAddressesInvolved) by UserId, CorrelationId
| project-away Auxiliar
| join kind = inner (
    union SigninLogs, AADNonInteractiveUserSignInLogs
    | where TimeGenerated > ago(query_period + query_wait)
    | where isnotempty(CorrelationId) and isnotempty(SessionId)
    ) on UserId, CorrelationId
| project-away *1
| summarize arg_min(CreatedDateTime, *) by UserId, HomeTenantId, ResourceTenantId, IPAddress, CorrelationId
| mv-apply NetworkLocationDetail = todynamic(NetworkLocationDetails) on (
    summarize
        //NetworkTypes = make_set(tostring(NetworkLocationDetail["networkType"])),
        NetworkNames = make_set(tostring(NetworkLocationDetail["networkNames"][0]))
    )
| where not(NetworkNames has_any (_TrustedNamedLocations))
| project IPAddressesInvolved, UserId, CorrelationId, SessionId
| join kind = inner (
    union SigninLogs, AADNonInteractiveUserSignInLogs
    | where TimeGenerated > ago(query_period + query_wait)
    | where isnotempty(SessionId)
    ) on UserId, SessionId
| project-away *1
| summarize
    arg_min(CreatedDateTime, *),
    AccesedApps = array_sort_asc(make_set_if(AppDisplayName, ResultType == 0, 50)),
    AccessedResources = array_sort_asc(make_set_if(ResourceDisplayName, ResultType == 0, 50)),
    SessionIds = make_set(SessionId),
    CorrelationIds = make_set(CorrelationId)
    by UserId, IPAddress, HomeTenantId, ResourceTenantId
| project
    TimeGenerated,
    CreatedDateTime,
    UserPrincipalName,
    UserDisplayName,
    SessionIds,
    IPAddressesInvolved,
    IPAddress,
    Location,
    NetworkLocationDetails,
    AutonomousSystemNumber,
    AuthenticationDetails,
    ClientAppUsed,
    DeviceDetail = coalesce(tostring(DeviceDetail_dynamic), DeviceDetail_string),
    UserAgent,
    Category,
    AccesedApps,
    AccessedResources,
    HomeTenantId,
    ResourceTenantId,
    CorrelationIds,
    UserId

Worth knowing

Microsoft published a Cloud Web Applications Threat Matrix on 9 September, organised by MITRE ATT&CK tactics and available at aka.ms/CloudWebAppsThreatMatrix. The premise is that web application security and cloud infrastructure security are usually investigated by different people with different tooling, and attackers move straight across the seam. Techniques are grouped under eleven tactics and include a lot that will not appear in an application-only threat model: subdomain takeover from services deleted without removing the DNS record, serverless trigger injection, deployment credential abuse, workload identity credential theft by querying the instance metadata service, development slots used for defence evasion, disabled cloud logging, connector reuse where an OAuth token or access key inside a managed connector becomes the lateral movement path, and denial-of-wallet, where the attacker simply triggers resource scaling until the bill becomes the damage. Microsoft positions Defender for Cloud and Defender XDR as the investigation surface across those signals. The practical use is not as a reading exercise but as a coverage audit — walk the matrix against your own estate and mark which rows you would actually see, which is the fastest way to find out that nobody is collecting the logs that would show connector reuse. (Microsoft Security Blog)