---
title: Hunt: Storm-3119 (YAM Store) tenant takeover via app-only secrets, PnP Management Shell and broad Graph grants | ctxsec
url: https://ctxsec.com/items/hunt-storm-3119-tenant-takeover
description: ""
status: "hunt idea"
published: 2026-10-14
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-storm-3119-tenant-takeover.md)

hunt idea

2026-10-14

### Hunt: Storm-3119 (YAM Store) tenant takeover via app-only secrets, PnP Management Shell and broad Graph grants

From Microsoft's Oct 14 writeup, the YAM Store pipeline runs like this. (1) Tor-routed Flask tooling profiles M365 tenants. (2) A stolen **application client secret** is used for _app-only_ directory control: silent password resets (no forced change at next sign-in), education license assignment and privileged attribute grants. (3) The actor signs in as a compromised Global Admin, self-provisions the **PnP Management Shell** service principal and grants it Microsoft Graph directory read/write, `AppCatalog.ReadWrite.All` and full SharePoint control. (4) SharePoint and OneDrive are then abused as bulk hosting. Hunt in Entra audit logs for a new PnP Management Shell service principal or consent in tenants that don't use PnP. Look for app-only password resets and license changes, new client secrets on existing apps, and spikes in SharePoint/OneDrive storage or external sharing. Also check for unexpected `.edu`/`.org`-style tenants sending you mail.

```
// KQL sketch (Entra AuditLogs)
AuditLogs
| where OperationName in ("Add service principal","Consent to application","Add app role assignment to service principal","Add delegated permission grant")
| where tostring(TargetResources) has_any ("PnP Management Shell","AppCatalog.ReadWrite.All")
| union (AuditLogs | where OperationName == "Reset user password" and isnotempty(InitiatedBy.app))
| project TimeGenerated, OperationName, InitiatedBy, TargetResources
```

Pair with the Conditional Access device-code block (see Tips) for the downstream device-code phishing.

Sources: [Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/)