M365 Token Replay Hunt: Campaign Addresses, Scripted Office Clients, Device Registration and Session Changes
Detects Microsoft 365 session token replay as described in the Huntress token spray research: sign-ins from the campaign addresses, scripted clients (node or a bare Mozilla/5.0 user agent) using the Office, Authentication Broker or OfficeHome app IDs from an address new to the account, Device Registration Service access from a new address and one session seen from different operating systems and addresses. The campaign address list is short lived and serves as enrichment.
Microsoft Sentinel (KQL)
