KQL Search

Query Details

Hunting For Suspicious Client Secret Authentication Attempts

Query

let UserSignIns = EntraIdSignInEvents
| where Timestamp > ago(7d) | where ErrorCode in (7000215, 7000222)
| project Timestamp, SourceTable = "UserSignIns", Application, IPAddress, Country, ErrorCode;
let SpnSignIns = EntraIdSpnSignInEvents | where Timestamp > ago(7d) | where ErrorCode in (7000215, 7000222)
| project Timestamp, SourceTable = "ServicePrincipalSignIns", Application, IPAddress, Country, ErrorCode;
union UserSignIns, SpnSignIns
| extend ErrorDescription = case(ErrorCode == 7000215, "Invalid client secret", ErrorCode == 7000222, "Expired client secret", "Other")

About this query

MITRE ATT&CK Technique(s)

Technique IDTitle
T1078.004Valid Accounts: Cloud Accounts

Author: Sergio Albea (05/11/2026)

Hunting for Suspicious Client Secret Authentication Attempt𝘀

Description: This week, I'm sharing a new article inspired by a recent investigation published by Todyl about attackers abusing stolen application credentials to authenticate as legitimate applications in Microsoft Entra ID. The interesting part? Attackers don't necessarily need to compromise a user account. A stolen client secret could be enough to access sensitive cloud resources, depending on the application's permissions. As usual, rather than focusing on IP-based IOCs that attackers can easily rotate, I prefer looking for Indicators of Attack (IOAs). For this hunt, I'm focusing on two Entra ID authentication errors:

  • AADSTS7000215 – Invalid client secret
  • AADSTS7000222 – Expired client secret

Additional Information: https://www.todyl.com/blog/stolen-app-credentials-real-access-an-actor-is-signing-into-entra-id-and-azure-devops-as-your-workloads

Explanation

This query is designed to help identify suspicious authentication attempts in Microsoft Entra ID by focusing on specific error codes related to client secrets. Here's a simple breakdown:

  1. Objective: The query aims to detect potential misuse of stolen application credentials, specifically focusing on client secrets used in cloud accounts.

  2. Context: Attackers can use stolen client secrets to access cloud resources without needing to compromise a user account. This is a security risk if the application has sensitive permissions.

  3. Focus: The query looks for two specific authentication errors:

    • AADSTS7000215: Indicates an invalid client secret.
    • AADSTS7000222: Indicates an expired client secret.

  4. Data Sources: The query examines sign-in events from two tables:

    • EntraIdSignInEvents: For user sign-in events.
    • EntraIdSpnSignInEvents: For service principal sign-in events.

  5. Time Frame: It analyzes events from the past 7 days.

  6. Output: The query combines results from both data sources and adds a descriptive label to each error code, indicating whether the issue was an invalid or expired client secret.

By focusing on these specific error codes, the query helps identify potential Indicators of Attack (IOAs) related to the misuse of client secrets, which can be a sign of unauthorized access attempts.