Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN

  1[metadata]
  2creation_date = "2026/05/26"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/05/26"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects Microsoft Entra ID sign-in activity where the Microsoft Authentication Broker requests the Device Registration
 11Service from a source autonomous system number (ASN) associated with VPN, residential proxy, or hosting egress commonly
 12observed in OAuth phishing and adversary-in-the-middle device registration flows. This pattern can indicate device join
 13or primary refresh token acquisition staged from attacker-controlled infrastructure after a user completes
 14authentication.
 15"""
 16false_positives = [
 17    """
 18    Users enrolling or joining devices while on corporate VPNs, consumer VPNs, or cloud egress that map to the listed
 19    ASNs may match. Legitimate mobile device management or bulk provisioning that uses the broker against Device
 20    Registration Service from the same networks can also trigger alerts. Baseline `source.as.organization.name` and
 21    successful broker-to-DRS sign-ins before tuning exclusions for approved ASNs or user groups.
 22    """,
 23]
 24from = "now-9m"
 25index = ["logs-azure.signinlogs-*"]
 26language = "kuery"
 27license = "Elastic License v2"
 28name = "Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN"
 29note = """## Triage and analysis
 30
 31### Investigating Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN
 32
 33Review `azure.signinlogs.properties.user_principal_name`, `azure.signinlogs.properties.app_display_name`,
 34`azure.signinlogs.properties.resource_display_name`, `azure.signinlogs.properties.session_id`, `source.ip`,
 35`source.as.number`, `source.as.organization.name`, and `user_agent.original`.
 36
 37Confirm whether the user intentionally registered or joined a device and whether the source ASN is expected for your
 38enrollment or remote-access programs.
 39
 40### Possible investigation steps
 41
 42- Correlate `azure.signinlogs.properties.session_id` with other sign-ins for the same user, especially multi-IP OAuth
 43  flows or follow-on primary refresh token usage.
 44- Review Entra ID audit logs for device registration activity around the same timestamp.
 45- Compare `source.as.organization.name` against approved VPN, MDM, and automation egress in your environment.
 46- Hunt for additional users signing in from the same ASN with the same application pair in a short window.
 47
 48### False positive analysis
 49
 50- Corporate or consumer VPN exit nodes that use ASNs in the rule list are a common source of benign matches during
 51  standard Windows or mobile device join.
 52- Cloud hosting or ISP NAT pools may intermittently map to listed ASNs without indicating compromise.
 53
 54### Response and remediation
 55
 56- If malicious, revoke refresh tokens for the user, disable suspicious registered devices, and reset credentials per
 57  policy.
 58- Review conditional access for the Microsoft Authentication Broker and device registration requirements.
 59- Escalate per incident procedures when paired with identity protection alerts or impossible travel.
 60"""
 61references = [
 62    "https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/",
 63    "https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/",
 64]
 65risk_score = 73
 66rule_id = "3d086f43-5382-493d-a018-bce165c88f9f"
 67severity = "high"
 68tags = [
 69    "Domain: Cloud",
 70    "Domain: Identity",
 71    "Data Source: Azure",
 72    "Data Source: Microsoft Entra ID",
 73    "Data Source: Microsoft Entra ID Sign-In Logs",
 74    "Use Case: Threat Detection",
 75    "Tactic: Initial Access",
 76    "Tactic: Persistence",
 77    "Resources: Investigation Guide",
 78]
 79timestamp_override = "event.ingested"
 80type = "query"
 81
 82query = '''
 83data_stream.dataset:"azure.signinlogs" and event.action:"Sign-in activity" and
 84source.as.number:(
 85    399629 or 14061 or 136787 or 9009 or 45102 or 215540 or 29802 or 62240 or 204957 or 395092 or 393406 or 400940 or
 86    59711 or 132203
 87) and
 88azure.signinlogs.properties.app_display_name:"Microsoft Authentication Broker" and
 89azure.signinlogs.properties.resource_display_name:"Device Registration Service"
 90'''
 91
 92[rule.investigation_fields]
 93field_names = [
 94    "@timestamp",
 95    "user.name",
 96    "user_agent.original",
 97    "source.ip",
 98    "source.as.number",
 99    "source.as.organization.name",
100    "source.geo.country_name",
101    "event.outcome",
102    "azure.signinlogs.properties.user_principal_name",
103    "azure.signinlogs.properties.session_id",
104    "azure.signinlogs.properties.app_display_name",
105    "azure.signinlogs.properties.app_id",
106    "azure.signinlogs.properties.resource_display_name",
107    "azure.signinlogs.properties.resource_id",
108    "azure.signinlogs.properties.authentication_protocol",
109    "azure.tenant_id",
110]
111
112[[rule.threat]]
113framework = "MITRE ATT&CK"
114
115[[rule.threat.technique]]
116id = "T1098"
117name = "Account Manipulation"
118reference = "https://attack.mitre.org/techniques/T1098/"
119
120[[rule.threat.technique.subtechnique]]
121id = "T1098.005"
122name = "Device Registration"
123reference = "https://attack.mitre.org/techniques/T1098/005/"
124
125[rule.threat.tactic]
126id = "TA0003"
127name = "Persistence"
128reference = "https://attack.mitre.org/tactics/TA0003/"
129
130[[rule.threat]]
131framework = "MITRE ATT&CK"
132
133[[rule.threat.technique]]
134id = "T1566"
135name = "Phishing"
136reference = "https://attack.mitre.org/techniques/T1566/"
137
138[[rule.threat.technique.subtechnique]]
139id = "T1566.002"
140name = "Spearphishing Link"
141reference = "https://attack.mitre.org/techniques/T1566/002/"
142
143[rule.threat.tactic]
144id = "TA0001"
145name = "Initial Access"
146reference = "https://attack.mitre.org/tactics/TA0001/"
147
148[[rule.threat]]
149framework = "MITRE ATT&CK"
150
151[[rule.threat.technique]]
152id = "T1550"
153name = "Use Alternate Authentication Material"
154reference = "https://attack.mitre.org/techniques/T1550/"
155
156[[rule.threat.technique.subtechnique]]
157id = "T1550.001"
158name = "Application Access Token"
159reference = "https://attack.mitre.org/techniques/T1550/001/"
160
161[rule.threat.tactic]
162id = "TA0005"
163name = "Defense Evasion"
164reference = "https://attack.mitre.org/tactics/TA0005/"