Microsoft Entra ID OAuth Phishing via Visual Studio Code Client

  1[metadata]
  2creation_date = "2025/04/23"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2025/04/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects potentially suspicious OAuth authorization activity in Microsoft Entra ID where the Visual Studio Code
 11first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph
 12resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it
 13in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode's
 14Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access
 15tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or
 16credential phishing activity.
 17"""
 18from = "now-25m"
 19index = ["filebeat-*", "logs-azure.signinlogs-*"]
 20language = "kuery"
 21license = "Elastic License v2"
 22name = "Microsoft Entra ID OAuth Phishing via Visual Studio Code Client"
 23note = """## Triage and analysis
 24
 25### Investigating Microsoft Entra ID OAuth Phishing via Visual Studio Code Client
 26
 27### Possible investigation steps
 28
 29- Identify the source IP address from which the failed login attempts originated by reviewing `source.ip`. Determine if the IP is associated with known malicious activity using threat intelligence sources or if it belongs to a corporate VPN, proxy, or automation process.
 30- Analyze affected user accounts by reviewing `azure.signinlogs.properties.user_principal_name` to determine if they belong to privileged roles or high-value users. Look for patterns indicating multiple failed attempts across different users, which could suggest a password spraying attempt.
 31- Examine the authentication method used in `azure.signinlogs.properties.authentication_details` to identify which authentication protocols were attempted and why they failed. Legacy authentication methods may be more susceptible to brute-force attacks.
 32- Review the authentication error codes found in `azure.signinlogs.properties.status.error_code` to understand why the login attempts failed. Common errors include `50126` for invalid credentials, `50053` for account lockouts, `50055` for expired passwords, and `50056` for users without a password.
 33- Correlate failed logins with other sign-in activity by looking at `event.outcome`. Identify if there were any successful logins from the same user shortly after multiple failures or if there are different geolocations or device fingerprints associated with the same account.
 34- Review `azure.signinlogs.properties.app_id` to identify which applications were initiating the authentication attempts. Determine if these applications are Microsoft-owned, third-party, or custom applications and if they are authorized to access the resources.
 35- Check for any conditional access policies that may have been triggered by the failed login attempts by reviewing `azure.signinlogs.properties.authentication_requirement`. This can help identify if the failed attempts were due to policy enforcement or misconfiguration.
 36
 37## False positive analysis
 38
 39- Automated scripts or applications using non-interactive authentication may trigger this detection, particularly if they rely on legacy authentication protocols recorded in `azure.signinlogs.properties.authentication_protocol`.
 40- Corporate proxies or VPNs may cause multiple users to authenticate from the same IP, appearing as repeated failed attempts under `source.ip`.
 41- User account lockouts from forgotten passwords or misconfigured applications may show multiple authentication failures in `azure.signinlogs.properties.status.error_code`.
 42- Exclude known trusted IPs, such as corporate infrastructure, from alerts by filtering `source.ip`.
 43- Exlcude known custom applications from `azure.signinlogs.properties.app_id` that are authorized to use non-interactive authentication.
 44- Ignore principals with a history of failed logins due to legitimate reasons, such as expired passwords or account lockouts, by filtering `azure.signinlogs.properties.user_principal_name`.
 45- Correlate sign-in failures with password reset events or normal user behavior before triggering an alert.
 46
 47## Response and remediation
 48
 49- Block the source IP address in `source.ip` if determined to be malicious.
 50- Reset passwords for all affected user accounts listed in `azure.signinlogs.properties.user_principal_name` and enforce stronger password policies.
 51- Ensure basic authentication is disabled for all applications using legacy authentication protocols listed in `azure.signinlogs.properties.authentication_protocol`.
 52- Enable multi-factor authentication (MFA) for impacted accounts to mitigate credential-based attacks.
 53- Review conditional access policies to ensure they are correctly configured to block unauthorized access attempts recorded in `azure.signinlogs.properties.authentication_requirement`.
 54- Review Conditional Access policies to enforce risk-based authentication and block unauthorized access attempts recorded in `azure.signinlogs.properties.authentication_requirement`.
 55- Implement a zero-trust security model by enforcing least privilege access and continuous authentication.
 56- Regularly review and update conditional access policies to ensure they are effective against evolving threats.
 57- Restrict the use of legacy authentication protocols by disabling authentication methods listed in `azure.signinlogs.properties.client_app_used`.
 58- Regularly audit authentication logs in `azure.signinlogs` to detect abnormal login behavior and ensure early detection of potential attacks.
 59- Regularly rotate client credentials and secrets for applications using non-interactive authentication to reduce the risk of credential theft.
 60"""
 61references = [
 62    "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema",
 63    "https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/",
 64]
 65risk_score = 47
 66rule_id = "14fa0285-fe78-4843-ac8e-f4b481f49da9"
 67severity = "medium"
 68tags = [
 69    "Domain: Cloud",
 70    "Data Source: Azure",
 71    "Data Source: Microsoft Entra ID",
 72    "Data Source: Microsoft Entra ID Sign-in Logs",
 73    "Use Case: Identity and Access Audit",
 74    "Resources: Investigation Guide",
 75    "Tactic: Initial Access",
 76]
 77timestamp_override = "event.ingested"
 78type = "query"
 79
 80query = '''
 81event.dataset: "azure.signinlogs" and
 82event.action: "Sign-in activity" and
 83event.outcome: "success" and
 84(
 85  azure.signinlogs.properties.resource_display_name: "Microsoft Graph" or
 86  azure.signinlogs.properties.resource_id: "00000003-0000-0000-c000-000000000000"
 87) and (
 88  azure.signinlogs.properties.app_id: "aebc6443-996d-45c2-90f0-388ff96faa56" or
 89  azure.signinlogs.properties.app_display_name: "Visual Studio Code"
 90)
 91'''
 92
 93
 94[[rule.threat]]
 95framework = "MITRE ATT&CK"
 96[[rule.threat.technique]]
 97id = "T1078"
 98name = "Valid Accounts"
 99reference = "https://attack.mitre.org/techniques/T1078/"
100[[rule.threat.technique.subtechnique]]
101id = "T1078.004"
102name = "Cloud Accounts"
103reference = "https://attack.mitre.org/techniques/T1078/004/"
104
105
106[[rule.threat.technique]]
107id = "T1566"
108name = "Phishing"
109reference = "https://attack.mitre.org/techniques/T1566/"
110[[rule.threat.technique.subtechnique]]
111id = "T1566.002"
112name = "Spearphishing Link"
113reference = "https://attack.mitre.org/techniques/T1566/002/"
114
115
116
117[rule.threat.tactic]
118id = "TA0001"
119name = "Initial Access"
120reference = "https://attack.mitre.org/tactics/TA0001/"