detecting-oauth-token-theft

name	detecting-oauth-token-theft
description	Detect and respond to OAuth token theft and replay in Microsoft Entra ID (Azure AD), covering access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, pass-the-cookie attacks, and Token Protection conditional access policies. Use for impossible-travel or anomalous token-usage alerts, suspected session hijacking, sign-in log analysis, or configuring token-binding defenses in Azure/M365.
domain	cybersecurity
subdomain	cloud-security
tags	["oauth","token-theft","azure-ad","entra-id","conditional-access","token-replay","identity-security","PRT"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack	["T1078.004","T1530","T1537","T1580"]
mitre_f3	{"version":"1.1","tactics":["initial-access","positioning"],"techniques":[{"id":"F1004","name":"Access with Stolen Session Cookie","tactic":"initial-access","source":"f3"},{"id":"T1539","name":"Steal Web Session Cookie","tactic":"positioning","source":"attack"},{"id":"T1557","name":"Adversary-in-the-Middle","tactic":"initial-access","source":"attack"},{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactic":"initial-access","source":"attack"},{"id":"F1006","name":"Account Takeover","tactic":"initial-access","source":"f3"},{"id":"T1185","name":"Browser Session Hijacking","tactic":"positioning","source":"attack"}]}

Detecting OAuth Token Theft

When to Use

• Investigating alerts for impossible travel or anomalous token usage in Microsoft Entra ID
• Responding to a suspected session hijacking or pass-the-cookie attack
• Configuring proactive defenses against OAuth token theft in an Azure/M365 environment
• Detecting OAuth device code phishing campaigns that bypass MFA
• Analyzing sign-in logs for token replay indicators
• Implementing Token Protection conditional access policies to bind tokens to devices

Do not use for on-premises Kerberos ticket attacks (pass-the-ticket, golden ticket); use Active Directory-specific investigation techniques for those scenarios.

Prerequisites

• Microsoft Entra ID P2 license (required for Identity Protection risk detections and conditional access)
• Global Administrator or Security Administrator role in the Entra admin center
• Microsoft Defender for Cloud Apps (MDCA) license for session anomaly detection
• Access to Entra ID Sign-in Logs and Audit Logs (requires Diagnostic Settings configured to Log Analytics or Sentinel)
• Familiarity with OAuth 2.0 authorization flows (authorization code, device code, client credentials)
• Microsoft Sentinel or equivalent SIEM ingesting Entra ID sign-in and audit logs

Workflow

Step 1: Understand the Token Theft Attack Surface

Identify which token types are at risk and how they are stolen:

Token Type            | Lifetime     | Theft Vector                    | Impact
----------------------|-------------|----------------------------------|------------------
Access Token          | 60-90 min   | Memory dump, proxy interception  | API access for token lifetime
Refresh Token         | Up to 90 days| Browser cookie theft, malware   | Persistent access, new access tokens
Primary Refresh Token | Session-based| Mimikatz, AADInternals, malware | Full SSO to all M365/Azure apps
Session Cookie        | Varies      | XSS, browser exploit, AitM proxy | Full session hijacking
Device Code Token     | 15 min auth | Phishing (device code flow abuse)| Attacker gets refresh token via social engineering

Common attack techniques:

• AitM Phishing (Adversary-in-the-Middle): Attacker proxies the legitimate login page via tools like Evilginx2, capturing session cookies and tokens after the user completes MFA
• Device Code Phishing: Attacker generates a device code, sends it to the victim via email/Teams, victim authenticates, attacker receives the token
• PRT Extraction: Attacker with local admin on a device extracts the Primary Refresh Token using Mimikatz () or AADInternals