Microsoft 365 guest user invited
An external (guest / B2B) user was invited to the tenant.
What it detects
An external (guest / B2B) user was invited to the tenant. Attackers invite an external identity they control as a low-noise foothold that keeps access to shared files and Teams after the initially compromised account is cleaned up.
MITRE ATT&CK mapping
False positives and triage
External collaboration invites guests all the time. The signal is an invite by an unexpected or recently compromised account, to an unknown external domain, or in a burst — correlate with the inviter's other activity and the guest's later access.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_guest_user_invited.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_guest_user_invited
version: 1.1.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1136.003, T1078.004]
description: |
An external (guest / B2B) user was invited to the tenant. Attackers invite an
external identity they control as a low-noise foothold that keeps access to
shared files and Teams after the initially compromised account is cleaned up.
match:
provider_any: [Office365, AzureAD]
event_action_contains_any:
- "Invite external user"
- "Redeem external user invitation"
- "Add external user to the directory"
correlation_keys: [user_name]
false_positive_guidance: |
External collaboration invites guests all the time. The signal is an invite by an
unexpected or recently compromised account, to an unknown external domain, or in a
burst — correlate with the inviter's other activity and the guest's later access.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.