Suspicious Entra ID OAuth Token Usage for First-Party Applications
Hypothesis: An adversary who has successfully phished a user for an OAuth authorization code or refresh token may use it in a non-interactive sign-in to abuse trusted first-party Microsoft applications for persistence or data exfiltration. This rule detects two primary scenarios observed in such campaigns: 1. A refresh token issued to the Microsoft Authentication Broker is used to access the Device Registration Service (DRS) with the 'adrs_access' scope. This is indicative of an adversary registering a new device to gain persistence via a Primary Refresh Token (PRT). 2. A token is used by the Visual Studio Code application to access the Microsoft Graph API. This can be used by an attacker who has phished an authorization code to exfiltrate data like emails.
Sigma
