Primary Refresh Token Access Attempt
This rule detects attempts to access a Primary Refresh Token (PRT) resource within Azure. A PRT is a key artifact used for single sign-on (SSO) in Azure AD, allowing users to maintain their authenticated state across various applications and services. Unauthorized access to a PRT can enable an adversary to move laterally within an organization's Azure environment, perform credential theft, and bypass multi-factor authentication (MFA) to gain access to resources as the legitimate user. This detection specifically looks for the 'attemptedPrtAccess' risk event type reported by Azure's risk detection service.
Sigma
