New Client Secret Added to Entra App Followed by Mail.ReadWrite Use
Detects a new client secret added to an Entra ID application shortly followed by Mail.ReadWrite Graph API calls, indicating the application was hijacked to impersonate its identity and read a target user's mailbox — the technique CISA's red team used after obtaining an access token.
Microsoft Sentinel (KQL)
