Skip to content

Instantly share code, notes, and snippets.

@invictus-korstiaan

invictus-korstiaan/Get-AzureAppTokens.csv

Created October 30, 2023 11:54
Show Gist options
  • Save invictus-korstiaan/954e5a046cfa080656c332ab261a85c4 to your computer and use it in GitHub Desktop.
Save invictus-korstiaan/954e5a046cfa080656c332ab261a85c4 to your computer and use it in GitHub Desktop.
Download ZIP
Get-AzureAppTokens
Raw
Get-AzureAppTokens.csv
Log source Indicator
AADServicePrincipalSignInLogs ServicePrincipalName == name-of-abused-SP
AADServicePrincipalSignInLogs AppId == ID-of-abused-app
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment