From Microsoft's Oct 14 writeup, the YAM Store pipeline runs like this. (1) Tor-routed Flask tooling profiles M365 tenants. (2) A stolen application client secret is used for app-only directory control: silent password resets (no forced change at next sign-in), education license assignment and privileged attribute grants. (3) The actor signs in as a compromised Global Admin, self-provisions the PnP Management Shell service principal and grants it Microsoft Graph directory read/write, AppCatalog.ReadWrite.All and full SharePoint control. (4) SharePoint and OneDrive are then abused as bulk hosting. Hunt in Entra audit logs for a new PnP Management Shell service principal or consent in tenants that don't use PnP. Look for app-only password resets and license changes, new client secrets on existing apps, and spikes in SharePoint/OneDrive storage or external sharing. Also check for unexpected .edu/.org-style tenants sending you mail.

// KQL sketch (Entra AuditLogs)
AuditLogs
| where OperationName in ("Add service principal","Consent to application","Add app role assignment to service principal","Add delegated permission grant")
| where tostring(TargetResources) has_any ("PnP Management Shell","AppCatalog.ReadWrite.All")
| union (AuditLogs | where OperationName == "Reset user password" and isnotempty(InitiatedBy.app))
| project TimeGenerated, OperationName, InitiatedBy, TargetResources

Pair with the Conditional Access device-code block (see Tips) for the downstream device-code phishing.