Invite External User

CSP: Azure

Tactics:

Persistence

Techniques:

T1136.003

Tags:

Azure Microsoft Entra ID

Event

Sends a B2B guest invitation to an external user, granting them access to the tenant’s resources.

Security Context

• Creating cloud accounts provides a durable backdoor that persists independently of any compromised user’s credentials.

Log Source

Entra ID Audit Logs

Sample Event

MITRE ATT&CK Mapping

Tactics: Persistence

Techniques:

• T1136.003 — Cloud Account — Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.