M365 sign-in followed by OAuth grant or device registration from a new IP

ills3c Intel&Coffee@Ills3C

•updated yesterday•6•0•9

Correlates a successful Entra ID sign-in from an unmanaged device/IP with a persistence action (such as OAuth consent, app permission grant, or device registration) performed by the same user from a different IP within 1 hour. This behavior is indicative of post-AiTM or device-code session hijacking where stolen tokens are replayed from attacker infrastructure.