Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP

  1[metadata]
  2creation_date = "2026/08/27"
  3integration = ["azure"]
  4maturity = "production"
  5min_stack_comments = "MV_CONTAINS was added to ES|QL in 9.2.0 and is not available on 8.19; 9.3.0 is the lowest supported 9.x release."
  6min_stack_version = "9.3.0"
  7updated_date = "2026/09/22"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects a first-party FOCI tooling client (Azure CLI, PowerShell, VS Code, Graph CLI, Azure AD PowerShell, or Visual
 13Studio) redeeming a device-bound Primary Refresh Token (PRT) for Microsoft Graph, SharePoint/OneDrive, or Exchange
 14Online from an IP that is not among that user and device's Windows Sign-In or WAM addresses. Replay events are limited
 15to compliant or Intune-managed devices: the stolen cookie keeps the workstation deviceid, so compliant-device
 16Conditional Access can succeed off-box.
 17"""
 18false_positives = [
 19    """
 20    A user running Azure CLI, Azure PowerShell, VS Code, Graph CLI, or Visual Studio on a jump host, Cloud Shell, or VPN
 21    egress that differs from the workstation's Windows Sign-In IP can match if that activity still presents a compliant
 22    or managed workstation deviceid. Validate whether the Graph client ran on the enrolled device before treating the
 23    event as cookie theft.
 24    """,
 25    """
 26    Split-tunnel or dual-homed devices may present different egress IPs for WAM versus Azure CLI. Confirm both IPs
 27    belong to the same physical device before raising severity.
 28    """,
 29    """
 30    Microsoft Teams, Microsoft Office, OneDrive SyncEngine, Microsoft Authentication Broker, Outlook Mobile, Bing, Azure
 31    Portal, ADIbizaUX, and Office 365 Management are omitted. The rest of the Secureworks known-foci-clients.csv family
 32    (Edge, OneDrive, Intune Company Portal, Windows Search, Authenticator, SharePoint, Planner, Power BI, and similar)
 33    is omitted for the same reason: routine workstation or mobile Graph whose Microsoft 365 egress often differs from
 34    the Windows Sign-In IP without cookie theft. Hunt those app_ids separately if harvest is already confirmed.
 35    """,
 36]
 37from = "now-24h"
 38interval = "1h"
 39language = "esql"
 40license = "Elastic License v2"
 41name = "Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP"
 42note = """## Triage and analysis
 43
 44### Investigating Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP
 45
 46Adversaries who steal a WAM PRT SSO cookie (BrowserCore / InteractiveToken harvest) redeem it off-box for Microsoft Graph, SharePoint/OneDrive, or Exchange Online using a first-party FOCI client. PRTremote uses Azure CLI (`04b07795-8ddb-461a-bbee-02f9e1bf7b46`); TokenTactics and AADInternals can use Azure AD PowerShell (`1b730954-1685-4b74-9bfd-dac224a7b894`) or Microsoft Office (`d3590ed6-52b3-4102-aeff-aad2292ab01c`) when refreshing a PRT into a Graph, Outlook, or SharePoint token. This rule keys on CLI / PowerShell / VS Code / Visual Studio, not Teams, Office, OneDrive SyncEngine, Authentication Broker, Outlook Mobile, Bing, or Azure Portal — those clients routinely egress on a different IP than Windows Sign-In. Hunt Office-client PRT separately if harvest is already confirmed. The issued access token carries the *workstation* `deviceid`, so Conditional Access policies that require a compliant device can succeed even though the redeeming IP is not the device. Replay events must be `is_compliant` or `is_managed` so the join tracks a stolen enrolled workstation PRT, not an unmanaged ROADtx device.
 47
 48This is not ConsentFix / OAuth-code phishing. Those flows show `OAuth2:Authorize` with `Redirect` and often lack a bound compliant device on the Graph token. Do not close this alert by following the first-party OAuth phishing playbook alone.
 49
 50
 51### Possible investigation steps
 52
 53- Review `azure.signinlogs.properties.user_principal_name`, `azure.signinlogs.properties.device_detail.device_id`, and `source.ip`. Confirm `incoming_token_type` on the replay events is `primaryRefreshToken` and `device_detail.is_compliant` / `is_managed` are true. `Esql.resource_display_name_values` should be Microsoft Graph, Office 365 SharePoint Online, OneDrive for Business, and/or Office 365 Exchange Online.
 54- Treat `Esql.source_ip_device_values` as the workstation (Windows Sign-In / `Windows-AzureAD-Authentication-Provider/1.0`) — the device the PRT was bound to, and the likely theft origin. Treat `source.ip` / `Esql.source_ip_replay_values` as Graph / SharePoint / Exchange PRT IPs that are not in that device-session set (the replay actor). On-box FOCI from the workstation IP is excluded from the replay set. The harvest emulation showed workstation public IP versus attacker SNAT — including Azure ASN 8075, so a Microsoft-owned ASN does not clear the alert. The stolen PRT cookie nonce is typically valid for about five minutes; that is the attacker’s redeem window, not this rule’s lookback. The workstation may have signed in hours earlier, so the query correlates 24 hours of Windows Sign-In / WAM IPs with the replay.
 55- Inspect `Esql.app_display_name_values` and `Esql.user_agent_original_values`. A cookie POST through WAM can show a Trident/MSIE user agent on the Azure CLI client ID; that is the same IE stack legitimate Windows `az login` uses when it brokers through WAM, so it is triage context, not a detection key. TokenTactics Graph refresh commonly presents as Microsoft Office (omitted here). A follow-on `python-requests/*` Graph token from the same session is tooling, not the first-party binary on the workstation.
 56- Hunt endpoint telemetry for the same user or `device_detail.display_name` as `host.name`: `svchost.exe` (Schedule) → `cmd.exe` → `BrowserCore.exe` with `<` / `>` redirection, or files `formatted_nonce.txt` / `prt_cookie.txt`.
 57- Intune audit (`create-clientcertificate`) is enrollment context only; it will not fire on the harvest. Use it as optional join on user OID, not as coverage.
 58- Review Graph, SharePoint, and mailbox activity after the replay for directory, file, or mail enumeration.
 59
 60### False positive analysis
 61
 62- Developers who run Azure CLI, Graph CLI, or VS Code from a different egress than Windows Sign-In while WAM still attaches the workstation deviceid. Exception known Cloud Shell / jump-host IPs after confirming the client actually ran there.
 63- Microsoft Teams, Office, OneDrive SyncEngine, Authentication Broker, Outlook Mobile, Bing, Azure Portal, and Office 365 Management Graph PRT are excluded. Do not treat their absence as a miss; they are omitted because split-tunnel M365 egress is routine.
 64- First sign-in of a new device can have sparse Windows Sign-In history in the 24-hour window; widen the hunt before responding.
 65- Hybrid-joined workstations that report both `is_compliant` and `is_managed` as false (no Intune) will not match the replay branch. Hunt those deviceids separately if harvest is already confirmed.
 66
 67### Response and remediation
 68
 69- Contact the user to confirm whether they ran the first-party client in `Esql.app_display_name_values` from the replay IP.
 70- If unauthorized, revoke refresh tokens and primary refresh tokens for the user. The deviceid on the token is often the *legitimate* workstation — do not delete that device as if it were a ROADtx registration until you confirm otherwise.
 71- Isolate the workstation, hunt for InteractiveToken scheduled tasks and BrowserCore harvest, and treat the admin identity that registered the task as a second compromised principal.
 72"""
 73references = [
 74    "https://www.armadin.com/blog-posts/prtremote-extract-prt-cookies-remotely-with-interactivetoken-scheduled-task",
 75    "https://github.com/armadin-public/PRTremote",
 76    "https://github.com/dmcxblue/ANIMO/blob/master/helpers/scripts/GrabTokenAzureAD/PrtExtractor.cs",
 77    "https://github.com/rvrsh3ll/TokenTactics",
 78    "https://github.com/Gerenios/AADInternals",
 79]
 80risk_score = 73
 81rule_id = "6a9fdaab-b50f-408d-b4da-54719f256d41"
 82setup = """The Azure Fleet integration (or Filebeat Azure module) with Microsoft Entra ID sign-in logs is required. Ingest `SignInLogs` and `NonInteractiveUserSignInLogs` into `logs-azure.signinlogs-*` so Windows Sign-In / WAM device activity and FOCI Graph, SharePoint, and Exchange token issuance are both available for the join.
 83
 84See [Microsoft Entra ID sign-in logs](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins) and the [Azure integration](https://docs.elastic.co/integrations/azure).
 85"""
 86severity = "high"
 87tags = [
 88    "Domain: Cloud",
 89    "Domain: Identity",
 90    "Use Case: Threat Detection",
 91    "Use Case: Identity and Access Audit",
 92    "Data Source: Azure",
 93    "Data Source: Microsoft Entra ID",
 94    "Data Source: Microsoft Entra ID Sign-In Logs",
 95    "Platform: Entra ID",
 96    "Tactic: Credential Access",
 97    "Tactic: Defense Evasion",
 98    "Tactic: Initial Access",
 99    "Resources: Investigation Guide",
100    "Rule Type: ES|QL",
101]
102timestamp_override = "event.ingested"
103type = "esql"
104
105query = '''
106from logs-azure.signinlogs-*
107// find successful sign-in events where a managed device exists
108| where event.dataset == "azure.signinlogs"
109    and azure.signinlogs.properties.status.error_code == 0
110    and azure.signinlogs.properties.device_detail.device_id is not null
111
112// filter for device sign-in events from Windows Sign-In or WAM (login session)
113| eval Esql.is_device_session = azure.signinlogs.properties.app_display_name == "Windows Sign In"
114    or user_agent.original == "Windows-AzureAD-Authentication-Provider/1.0"
115
116// filter for tooling FOCI clients that can redeem a PRT (replay)
117| eval Esql.is_prt_replay = azure.signinlogs.properties.app_id in (
118        "04b07795-8ddb-461a-bbee-02f9e1bf7b46",  // Microsoft Azure CLI
119        "1950a258-227b-4e31-a9cf-717495945fc2",  // Microsoft Azure PowerShell
120        "aebc6443-996d-45c2-90f0-388ff96faa56",  // Visual Studio Code
121        "14d82eec-204b-4c2f-b7e8-296a70dab67e",  // Microsoft Graph Command Line Tools
122        "1b730954-1685-4b74-9bfd-dac224a7b894",  // Azure Active Directory PowerShell
123        "872cd9fa-d31f-45e0-9eab-6e460a02d1f1"   // Visual Studio
124    )
125
126    // target resource are common adversary targets for access
127    and azure.signinlogs.properties.resource_id in (
128        "00000003-0000-0000-c000-000000000000",  // Microsoft Graph
129        "00000003-0000-0ff1-ce00-000000000000",  // Office 365 SharePoint Online
130        "6a9b9266-8161-4a7b-913a-a9eda19da220",  // OneDrive for Business
131        "00000002-0000-0ff1-ce00-000000000000"   // Office 365 Exchange Online
132    )
133    and azure.signinlogs.properties.incoming_token_type == "primaryRefreshToken"
134    and (
135        azure.signinlogs.properties.device_detail.is_compliant == true
136        or azure.signinlogs.properties.device_detail.is_managed == true
137    )
138
139// device session or PRT replay event have to exist
140| where Esql.is_device_session or Esql.is_prt_replay
141
142// aggregate entities for both device session and PRT replay events
143// aggregate by user and device
144| stats
145    Esql.source_ip_device_values = values(source.ip) where Esql.is_device_session,
146    Esql.source_ip_replay_values = values(source.ip) where Esql.is_prt_replay,
147    Esql.event_count_replay = count(*) where Esql.is_prt_replay,
148    Esql.event_count_device_session = count(*) where Esql.is_device_session,
149    Esql.user_principal_name_values = values(azure.signinlogs.properties.user_principal_name),
150    Esql.app_display_name_values = values(azure.signinlogs.properties.app_display_name) where Esql.is_prt_replay,
151    Esql.resource_id_values = values(azure.signinlogs.properties.resource_id) where Esql.is_prt_replay,
152    Esql.resource_display_name_values = values(azure.signinlogs.properties.resource_display_name) where Esql.is_prt_replay,
153    Esql.device_display_name_values = values(azure.signinlogs.properties.device_detail.display_name),
154    Esql.user_agent_original_values = values(user_agent.original) where Esql.is_prt_replay,
155    Esql.device_is_compliant_values = values(azure.signinlogs.properties.device_detail.is_compliant) where Esql.is_prt_replay,
156    Esql.device_is_managed_values = values(azure.signinlogs.properties.device_detail.is_managed) where Esql.is_prt_replay,
157    Esql.authentication_requirement_values = values(azure.signinlogs.properties.authentication_requirement) where Esql.is_prt_replay,
158    Esql.conditional_access_status_values = values(azure.signinlogs.properties.conditional_access_status) where Esql.is_prt_replay,
159    Esql.earliest_timestamp = min(@timestamp),
160    Esql.latest_timestamp = max(@timestamp)
161  by azure.signinlogs.properties.user_id, azure.signinlogs.properties.device_detail.device_id
162
163// filter for PRT replay events that have at least one replay IP
164| where Esql.event_count_replay > 0
165    and Esql.event_count_device_session > 0
166    and Esql.source_ip_replay_values is not null
167    and Esql.source_ip_device_values is not null
168
169// expand the replay IP list and keep only IPs that are not in the device-session set
170| mv_expand Esql.source_ip_replay_values
171| where not mv_contains(Esql.source_ip_device_values, Esql.source_ip_replay_values)
172| eval Esql.source_ip_replay = Esql.source_ip_replay_values,
173       user.id = azure.signinlogs.properties.user_id,
174       source.ip = Esql.source_ip_replay_values
175| keep
176    user.id,
177    source.ip,
178    azure.signinlogs.properties.user_id,
179    azure.signinlogs.properties.device_detail.device_id,
180    Esql.*
181'''
182
183
184[[rule.threat]]
185framework = "MITRE ATT&CK"
186[[rule.threat.technique]]
187id = "T1528"
188name = "Steal Application Access Token"
189reference = "https://attack.mitre.org/techniques/T1528/"
190
191[[rule.threat.technique]]
192id = "T1539"
193name = "Steal Web Session Cookie"
194reference = "https://attack.mitre.org/techniques/T1539/"
195
196
197[rule.threat.tactic]
198id = "TA0006"
199name = "Credential Access"
200reference = "https://attack.mitre.org/tactics/TA0006/"
201[[rule.threat]]
202framework = "MITRE ATT&CK"
203[[rule.threat.technique]]
204id = "T1550"
205name = "Use Alternate Authentication Material"
206reference = "https://attack.mitre.org/techniques/T1550/"
207[[rule.threat.technique.subtechnique]]
208id = "T1550.001"
209name = "Application Access Token"
210reference = "https://attack.mitre.org/techniques/T1550/001/"
211
212
213
214[rule.threat.tactic]
215id = "TA0005"
216name = "Defense Evasion"
217reference = "https://attack.mitre.org/tactics/TA0005/"
218[[rule.threat]]
219framework = "MITRE ATT&CK"
220[[rule.threat.technique]]
221id = "T1078"
222name = "Valid Accounts"
223reference = "https://attack.mitre.org/techniques/T1078/"
224[[rule.threat.technique.subtechnique]]
225id = "T1078.004"
226name = "Cloud Accounts"
227reference = "https://attack.mitre.org/techniques/T1078/004/"
228
229
230
231[rule.threat.tactic]
232id = "TA0001"
233name = "Initial Access"
234reference = "https://attack.mitre.org/tactics/TA0001/"
235
236[rule.investigation_fields]
237field_names = [
238    "user.id",
239    "source.ip",
240    "azure.signinlogs.properties.user_id",
241    "azure.signinlogs.properties.device_detail.device_id",
242    "Esql.user_principal_name_values",
243    "Esql.device_display_name_values",
244    "Esql.source_ip_device_values",
245    "Esql.source_ip_replay_values",
246    "Esql.app_display_name_values",
247    "Esql.resource_display_name_values",
248    "Esql.user_agent_original_values",
249    "Esql.device_is_compliant_values",
250    "Esql.device_is_managed_values",
251]