ConsentFix — Entra ID OAuth Phishing & Token Theft

Looks for: non-interactive sign-ins to Azure CLI / VS Code / Auth Broker using a refresh token. Accomplishes: surfaces the token-redemption stage — the core ConsentFix signal. FP: legit Azure CLI/PowerShell automation — exclude sanctioned principals + known egress IPs.

// HUNT: Non-interactive first-party-app token redemption (ConsentFix)
// MITRE: T1528, T1550.001, T1078.004 | CONF: med-high  FP: med  COST: low-med
// REQUIRES: Entra ID sign-in logs ingested into NG-SIEM; NOTE: field tokens depend on your parser — validate
// TUNING: these three appIds (Azure CLI, PowerShell, Auth Broker) are used non-interactively all day by sanctioned automation -- exclude your service principals and CI egress ASNs first. A real hit is a human userPrincipalName redeeming from an autonomousSystemNumber that user has no history with; rank by first-seen (user, ASN) pairs, not by raw count.
appId=/^(04b07795-8ddb-461a-bbee-02f9e1bf7b46|aebc6443-996d-45c2-90f0-388ff96faa56|29d9ed98-a469-4536-ade2-f981bc1d605e)$/i
| isInteractive=false
| incomingTokenType=/refreshToken/i
| groupBy([userPrincipalName, appDisplayName, ipAddress, autonomousSystemNumber], function=count())
| table([userPrincipalName, appDisplayName, ipAddress, autonomousSystemNumber, _count], limit=200)

Looks for: one session ID observed from two or more distinct IPs in a short window. Accomplishes: high-fidelity evidence of a hijacked/replayed token — victim and attacker sharing a session.

// HUNT: One session ID seen from multiple IPs (session/token reuse)
// MITRE: T1550.001, T1078.004 | CONF: high  FP: low-med  COST: med
// TUNING: require >=2 distinct ASNs or geo-distant IPs; window to ~30 min
| groupBy([sessionId], function=[count(field=ipAddress, distinct=true, as=ipCount), collect([ipAddress, userPrincipalName, autonomousSystemNumber])])
| ipCount>=2
| table([sessionId, userPrincipalName, ipCount, ipAddress, autonomousSystemNumber], limit=200)

Looks for: non-interactive sign-ins carrying .default, offline_access, or adrs scopes via a first-party client. FP: apps request these routinely — combine with a new IP/ASN (Q1) or unbound status (Q6).

// HUNT: Non-interactive sign-in with broad/offline OAuth scopes
// MITRE: T1528, T1606.002 | CONF: medium  FP: medium  COST: low-med
// TUNING: AND with Q1 (new IP) or Q6 (unbound); scope to first-party native clients
| isInteractive=false
| scopeDetail=/(\.default|offline_access|adrs_access)/i
| appId=/^(04b07795|aebc6443|29d9ed98)/i
| table([userPrincipalName, appDisplayName, scopeDetail, ipAddress, resourceDisplayName], limit=200)

Looks for: "Add device" + "Add registered owner/users" by DRS sharing one correlation ID in a ~1-minute window. Accomplishes: catches automated device registration used for PRT-based persistence. FP: bulk Autopilot/Intune enrollment — usually a distinct correlation pattern.

// HUNT: Burst DRS device-registration sequence (persistence)
// MITRE: T1098.005 | CONF: high  FP: low  COST: med
// TUNING: scope to DRS-initiated events; flag OS build 10.0.19041.928 and >=2 ops/correlationId/minute
operationName=/Add device|Add registered (owner|users) to device/i
| groupBy([correlationId], function=[count(as=ops), collect([operationName, userPrincipalName, targetDeviceId])])
| ops>=2
| table([correlationId, ops, operationName, userPrincipalName, targetDeviceId], limit=200)

Looks for: Auth Broker / ADRS token requests producing a PRT for a device ID first seen in this window with an unbound session. Accomplishes: catches the persistence escalation after device registration. FP: genuine first-enrollment — correlate with Q4.

// HUNT: PRT issuance to a newly observed device (unbound)
// MITRE: T1098.005, T1550.001 | CONF: med-high  FP: low-med  COST: med
// TUNING: correlate with Q4 on userPrincipalName/time; require unbound session + first-seen deviceId
appId=/^29d9ed98-a469-4536-ade2-f981bc1d605e$/i
| incomingTokenType=/refreshToken|primaryRefreshToken/i
| signInSessionStatus=/unbound/i
| table([userPrincipalName, deviceId, ipAddress, signInSessionStatus, @timestamp], limit=200)

Looks for: sign-ins where the token-protection session status is unbound. Accomplishes: directly flags tokens not bound to their original device — the hallmark of replay. FP: clients not yet supporting token binding — baseline these first.

// HUNT: Unbound token-protection sessions on first-party apps
// MITRE: T1550.001, T1606.002 | CONF: med-high  FP: low-med  COST: low
// REQUIRES: Token Protection enabled in CA
// TUNING: baseline expected unbound clients first
| signInSessionStatus=/unbound/i
| appId=/^(04b07795|aebc6443|29d9ed98)/i
| table([userPrincipalName, appDisplayName, ipAddress, signInSessionStatus, @timestamp], limit=200)