Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP

  1[metadata]
  2creation_date = "2026/08/27"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/08/27"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects a first-party FOCI tooling client (Azure CLI, PowerShell, VS Code, Graph CLI, Azure AD PowerShell, or Visual
 11Studio) redeeming a device-bound Primary Refresh Token (PRT) for Microsoft Graph, SharePoint/OneDrive, or Exchange
 12Online from an IP that is not among that user and device's Windows Sign-In or WAM addresses. Replay events are limited
 13to compliant or Intune-managed devices: the stolen cookie keeps the workstation deviceid, so compliant-device
 14Conditional Access can succeed off-box.
 15"""
 16false_positives = [
 17    """
 18    A user running Azure CLI, Azure PowerShell, VS Code, Graph CLI, or Visual Studio on a jump host, Cloud Shell, or VPN
 19    egress that differs from the workstation's Windows Sign-In IP can match if that activity still presents a compliant
 20    or managed workstation deviceid. Validate whether the Graph client ran on the enrolled device before treating the
 21    event as cookie theft.
 22    """,
 23    """
 24    Split-tunnel or dual-homed devices may present different egress IPs for WAM versus Azure CLI. Confirm both IPs
 25    belong to the same physical device before raising severity.
 26    """,
 27    """
 28    Microsoft Teams, Microsoft Office, OneDrive SyncEngine, Microsoft Authentication Broker, Outlook Mobile, Bing, Azure
 29    Portal, ADIbizaUX, and Office 365 Management are omitted. The rest of the Secureworks known-foci-clients.csv family
 30    (Edge, OneDrive, Intune Company Portal, Windows Search, Authenticator, SharePoint, Planner, Power BI, and similar)
 31    is omitted for the same reason: routine workstation or mobile Graph whose Microsoft 365 egress often differs from
 32    the Windows Sign-In IP without cookie theft. Hunt those app_ids separately if harvest is already confirmed.
 33    """,
 34]
 35from = "now-24h"
 36interval = "1h"
 37language = "esql"
 38license = "Elastic License v2"
 39name = "Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP"
 40note = """## Triage and analysis
 41
 42### Investigating Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP
 43
 44Adversaries who steal a WAM PRT SSO cookie (BrowserCore / InteractiveToken harvest) redeem it off-box for Microsoft Graph, SharePoint/OneDrive, or Exchange Online using a first-party FOCI client. PRTremote uses Azure CLI (`04b07795-8ddb-461a-bbee-02f9e1bf7b46`); TokenTactics and AADInternals can use Azure AD PowerShell (`1b730954-1685-4b74-9bfd-dac224a7b894`) or Microsoft Office (`d3590ed6-52b3-4102-aeff-aad2292ab01c`) when refreshing a PRT into a Graph, Outlook, or SharePoint token. This rule keys on CLI / PowerShell / VS Code / Visual Studio, not Teams, Office, OneDrive SyncEngine, Authentication Broker, Outlook Mobile, Bing, or Azure Portal — those clients routinely egress on a different IP than Windows Sign-In. Hunt Office-client PRT separately if harvest is already confirmed. The issued access token carries the *workstation* `deviceid`, so Conditional Access policies that require a compliant device can succeed even though the redeeming IP is not the device. Replay events must be `is_compliant` or `is_managed` so the join tracks a stolen enrolled workstation PRT, not an unmanaged ROADtx device.
 45
 46This is not ConsentFix / OAuth-code phishing. Those flows show `OAuth2:Authorize` with `Redirect` and often lack a bound compliant device on the Graph token. Do not close this alert by following the first-party OAuth phishing playbook alone.
 47
 48
 49### Possible investigation steps
 50
 51- Review `azure.signinlogs.properties.user_principal_name`, `azure.signinlogs.properties.device_detail.device_id`, and `source.ip`. Confirm `incoming_token_type` on the replay events is `primaryRefreshToken` and `device_detail.is_compliant` / `is_managed` are true. `Esql.resource_display_name_values` should be Microsoft Graph, Office 365 SharePoint Online, OneDrive for Business, and/or Office 365 Exchange Online.
 52- Treat `Esql.source_ip_device_values` as the workstation (Windows Sign-In / `Windows-AzureAD-Authentication-Provider/1.0`) — the device the PRT was bound to, and the likely theft origin. Treat `source.ip` / `Esql.source_ip_replay_values` as Graph / SharePoint / Exchange PRT IPs that are not in that device-session set (the replay actor). On-box FOCI from the workstation IP is excluded from the replay set. The harvest emulation showed workstation public IP versus attacker SNAT — including Azure ASN 8075, so a Microsoft-owned ASN does not clear the alert. The stolen PRT cookie nonce is typically valid for about five minutes; that is the attacker’s redeem window, not this rule’s lookback. The workstation may have signed in hours earlier, so the query correlates 24 hours of Windows Sign-In / WAM IPs with the replay.
 53- Inspect `Esql.app_display_name_values` and `Esql.user_agent_original_values`. A cookie POST through WAM can show a Trident/MSIE user agent on the Azure CLI client ID; that is the same IE stack legitimate Windows `az login` uses when it brokers through WAM, so it is triage context, not a detection key. TokenTactics Graph refresh commonly presents as Microsoft Office (omitted here). A follow-on `python-requests/*` Graph token from the same session is tooling, not the first-party binary on the workstation.
 54- Hunt endpoint telemetry for the same user or `device_detail.display_name` as `host.name`: `svchost.exe` (Schedule) → `cmd.exe` → `BrowserCore.exe` with `<` / `>` redirection, or files `formatted_nonce.txt` / `prt_cookie.txt`.
 55- Intune audit (`create-clientcertificate`) is enrollment context only; it will not fire on the harvest. Use it as optional join on user OID, not as coverage.
 56- Review Graph, SharePoint, and mailbox activity after the replay for directory, file, or mail enumeration.
 57
 58### False positive analysis
 59
 60- Developers who run Azure CLI, Graph CLI, or VS Code from a different egress than Windows Sign-In while WAM still attaches the workstation deviceid. Exception known Cloud Shell / jump-host IPs after confirming the client actually ran there.
 61- Microsoft Teams, Office, OneDrive SyncEngine, Authentication Broker, Outlook Mobile, Bing, Azure Portal, and Office 365 Management Graph PRT are excluded. Do not treat their absence as a miss; they are omitted because split-tunnel M365 egress is routine.
 62- First sign-in of a new device can have sparse Windows Sign-In history in the 24-hour window; widen the hunt before responding.
 63- Hybrid-joined workstations that report both `is_compliant` and `is_managed` as false (no Intune) will not match the replay branch. Hunt those deviceids separately if harvest is already confirmed.
 64
 65### Response and remediation
 66
 67- Contact the user to confirm whether they ran the first-party client in `Esql.app_display_name_values` from the replay IP.
 68- If unauthorized, revoke refresh tokens and primary refresh tokens for the user. The deviceid on the token is often the *legitimate* workstation — do not delete that device as if it were a ROADtx registration until you confirm otherwise.
 69- Isolate the workstation, hunt for InteractiveToken scheduled tasks and BrowserCore harvest, and treat the admin identity that registered the task as a second compromised principal.
 70"""
 71references = [
 72    "https://www.armadin.com/blog-posts/prtremote-extract-prt-cookies-remotely-with-interactivetoken-scheduled-task",
 73    "https://github.com/armadin-public/PRTremote",
 74    "https://github.com/dmcxblue/ANIMO/blob/master/helpers/scripts/GrabTokenAzureAD/PrtExtractor.cs",
 75    "https://github.com/rvrsh3ll/TokenTactics",
 76    "https://github.com/Gerenios/AADInternals",
 77]
 78risk_score = 73
 79rule_id = "6a9fdaab-b50f-408d-b4da-54719f256d41"
 80setup = """The Azure Fleet integration (or Filebeat Azure module) with Microsoft Entra ID sign-in logs is required. Ingest `SignInLogs` and `NonInteractiveUserSignInLogs` into `logs-azure.signinlogs-*` so Windows Sign-In / WAM device activity and FOCI Graph, SharePoint, and Exchange token issuance are both available for the join.
 81
 82See [Microsoft Entra ID sign-in logs](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins) and the [Azure integration](https://docs.elastic.co/integrations/azure).
 83"""
 84severity = "high"
 85tags = [
 86    "Domain: Cloud",
 87    "Domain: Identity",
 88    "Use Case: Threat Detection",
 89    "Use Case: Identity and Access Audit",
 90    "Data Source: Azure",
 91    "Data Source: Microsoft Entra ID",
 92    "Data Source: Microsoft Entra ID Sign-in Logs",
 93    "Platform: Entra ID",
 94    "Tactic: Credential Access",
 95    "Tactic: Defense Evasion",
 96    "Tactic: Initial Access",
 97    "Resources: Investigation Guide",
 98    "Rule Type: ESQL",
 99]
100timestamp_override = "event.ingested"
101type = "esql"
102
103query = '''
104from logs-azure.signinlogs-*
105// find successful sign-in events where a managed device exists
106| where event.dataset == "azure.signinlogs"
107    and azure.signinlogs.properties.status.error_code == 0
108    and azure.signinlogs.properties.device_detail.device_id is not null
109
110// filter for device sign-in events from Windows Sign-In or WAM (login session)
111| eval Esql.is_device_session = azure.signinlogs.properties.app_display_name == "Windows Sign In"
112    or user_agent.original == "Windows-AzureAD-Authentication-Provider/1.0"
113
114// filter for tooling FOCI clients that can redeem a PRT (replay)
115| eval Esql.is_prt_replay = azure.signinlogs.properties.app_id in (
116        "04b07795-8ddb-461a-bbee-02f9e1bf7b46",  // Microsoft Azure CLI
117        "1950a258-227b-4e31-a9cf-717495945fc2",  // Microsoft Azure PowerShell
118        "aebc6443-996d-45c2-90f0-388ff96faa56",  // Visual Studio Code
119        "14d82eec-204b-4c2f-b7e8-296a70dab67e",  // Microsoft Graph Command Line Tools
120        "1b730954-1685-4b74-9bfd-dac224a7b894",  // Azure Active Directory PowerShell
121        "872cd9fa-d31f-45e0-9eab-6e460a02d1f1"   // Visual Studio
122    )
123
124    // target resource are common adversary targets for access
125    and azure.signinlogs.properties.resource_id in (
126        "00000003-0000-0000-c000-000000000000",  // Microsoft Graph
127        "00000003-0000-0ff1-ce00-000000000000",  // Office 365 SharePoint Online
128        "6a9b9266-8161-4a7b-913a-a9eda19da220",  // OneDrive for Business
129        "00000002-0000-0ff1-ce00-000000000000"   // Office 365 Exchange Online
130    )
131    and azure.signinlogs.properties.incoming_token_type == "primaryRefreshToken"
132    and (
133        azure.signinlogs.properties.device_detail.is_compliant == true
134        or azure.signinlogs.properties.device_detail.is_managed == true
135    )
136
137// device session or PRT replay event have to exist
138| where Esql.is_device_session or Esql.is_prt_replay
139
140// aggregate entities for both device session and PRT replay events
141// aggregate by user and device
142| stats
143    Esql.source_ip_device_values = values(source.ip) where Esql.is_device_session,
144    Esql.source_ip_replay_values = values(source.ip) where Esql.is_prt_replay,
145    Esql.event_count_replay = count(*) where Esql.is_prt_replay,
146    Esql.event_count_device_session = count(*) where Esql.is_device_session,
147    Esql.user_principal_name_values = values(azure.signinlogs.properties.user_principal_name),
148    Esql.app_display_name_values = values(azure.signinlogs.properties.app_display_name) where Esql.is_prt_replay,
149    Esql.resource_id_values = values(azure.signinlogs.properties.resource_id) where Esql.is_prt_replay,
150    Esql.resource_display_name_values = values(azure.signinlogs.properties.resource_display_name) where Esql.is_prt_replay,
151    Esql.device_display_name_values = values(azure.signinlogs.properties.device_detail.display_name),
152    Esql.user_agent_original_values = values(user_agent.original) where Esql.is_prt_replay,
153    Esql.device_is_compliant_values = values(azure.signinlogs.properties.device_detail.is_compliant) where Esql.is_prt_replay,
154    Esql.device_is_managed_values = values(azure.signinlogs.properties.device_detail.is_managed) where Esql.is_prt_replay,
155    Esql.authentication_requirement_values = values(azure.signinlogs.properties.authentication_requirement) where Esql.is_prt_replay,
156    Esql.conditional_access_status_values = values(azure.signinlogs.properties.conditional_access_status) where Esql.is_prt_replay,
157    Esql.earliest_timestamp = min(@timestamp),
158    Esql.latest_timestamp = max(@timestamp)
159  by azure.signinlogs.properties.user_id, azure.signinlogs.properties.device_detail.device_id
160
161// filter for PRT replay events that have at least one replay IP
162| where Esql.event_count_replay > 0
163    and Esql.event_count_device_session > 0
164    and Esql.source_ip_replay_values is not null
165    and Esql.source_ip_device_values is not null
166
167// expand the replay IP list and keep only IPs that are not in the device-session set
168| mv_expand Esql.source_ip_replay_values
169| where not mv_contains(Esql.source_ip_device_values, Esql.source_ip_replay_values)
170| eval Esql.source_ip_replay = Esql.source_ip_replay_values,
171       user.id = azure.signinlogs.properties.user_id,
172       source.ip = Esql.source_ip_replay_values
173| keep
174    user.id,
175    source.ip,
176    azure.signinlogs.properties.user_id,
177    azure.signinlogs.properties.device_detail.device_id,
178    Esql.*
179'''
180
181
182[[rule.threat]]
183framework = "MITRE ATT&CK"
184[[rule.threat.technique]]
185id = "T1528"
186name = "Steal Application Access Token"
187reference = "https://attack.mitre.org/techniques/T1528/"
188
189[[rule.threat.technique]]
190id = "T1539"
191name = "Steal Web Session Cookie"
192reference = "https://attack.mitre.org/techniques/T1539/"
193
194
195[rule.threat.tactic]
196id = "TA0006"
197name = "Credential Access"
198reference = "https://attack.mitre.org/tactics/TA0006/"
199[[rule.threat]]
200framework = "MITRE ATT&CK"
201[[rule.threat.technique]]
202id = "T1550"
203name = "Use Alternate Authentication Material"
204reference = "https://attack.mitre.org/techniques/T1550/"
205[[rule.threat.technique.subtechnique]]
206id = "T1550.001"
207name = "Application Access Token"
208reference = "https://attack.mitre.org/techniques/T1550/001/"
209
210
211
212[rule.threat.tactic]
213id = "TA0005"
214name = "Defense Evasion"
215reference = "https://attack.mitre.org/tactics/TA0005/"
216[[rule.threat]]
217framework = "MITRE ATT&CK"
218[[rule.threat.technique]]
219id = "T1078"
220name = "Valid Accounts"
221reference = "https://attack.mitre.org/techniques/T1078/"
222[[rule.threat.technique.subtechnique]]
223id = "T1078.004"
224name = "Cloud Accounts"
225reference = "https://attack.mitre.org/techniques/T1078/004/"
226
227
228
229[rule.threat.tactic]
230id = "TA0001"
231name = "Initial Access"
232reference = "https://attack.mitre.org/tactics/TA0001/"
233
234[rule.investigation_fields]
235field_names = [
236    "user.id",
237    "source.ip",
238    "azure.signinlogs.properties.user_id",
239    "azure.signinlogs.properties.device_detail.device_id",
240    "Esql.user_principal_name_values",
241    "Esql.device_display_name_values",
242    "Esql.source_ip_device_values",
243    "Esql.source_ip_replay_values",
244    "Esql.app_display_name_values",
245    "Esql.resource_display_name_values",
246    "Esql.user_agent_original_values",
247    "Esql.device_is_compliant_values",
248    "Esql.device_is_managed_values",
249]