Application Access Token

let TimeWindow = 24h;
let SuspiciousUserAgents = dynamic([
    "python-requests", "curl/", "wget/", "Go-http-client",
    "okhttp/", "node-fetch", "axios/", "PostmanRuntime", "libcurl",
    "ruby", "aiohttp", "httpx", "java/"
]);
let SensitiveResources = dynamic([
    "Microsoft Graph", "Office 365 Exchange Online", "SharePoint Online",
    "Microsoft Teams", "OneDrive", "Azure Key Vault",
    "Windows Azure Service Management API"
]);
// Detect suspicious non-interactive (token-based) sign-ins bypassing MFA
AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(TimeWindow)
| where ResultType == 0
| where AuthenticationRequirement =~ "singleFactorAuthentication"
| where ConditionalAccessStatus in~ ("notApplied", "disabled", "notEnabled")
| extend
    HasSuspiciousAgent = UserAgent has_any (SuspiciousUserAgents),
    AccessedSensitiveResource = ResourceDisplayName has_any (SensitiveResources)
| where HasSuspiciousAgent or AccessedSensitiveResource
| summarize
    TokenUseCount = count(),
    UniqueResources = dcount(ResourceDisplayName),
    UniqueApps = dcount(AppDisplayName),
    UniqueIPs = dcount(IPAddress),
    Resources = make_set(ResourceDisplayName, 10),
    Apps = make_set(AppDisplayName, 5),
    SourceIPs = make_set(IPAddress, 5),
    UserAgents = make_set(UserAgent, 3),
    Countries = make_set(tostring(LocationDetails.countryOrRegion), 5)
  by UserPrincipalName, bin(TimeGenerated, 1h)
| where TokenUseCount > 10 or UniqueResources >= 3 or UniqueIPs >= 2
| extend RiskIndicator = case(
    UniqueIPs >= 3, "Token used from 3+ distinct IPs — likely shared or stolen token",
    UniqueResources >= 5, "Token accessing 5+ resources — automated enumeration pattern",
    TokenUseCount > 50, "High-frequency API access — scripted tool or automation",
    "Suspicious single-factor token-based authentication to sensitive resource"
  )
| project TimeGenerated, UserPrincipalName, TokenUseCount, UniqueResources, UniqueApps,
          UniqueIPs, Resources, Apps, SourceIPs, UserAgents, Countries, RiskIndicator
| sort by TokenUseCount desc

index=o365 sourcetype="o365:management:activity"
    (Operation="MailItemsAccessed" OR Operation="FileAccessed" OR Operation="FileDownloaded"
     OR Operation="SearchQueryInitiatedExchange" OR Operation="Send" OR Operation="MessageBind"
     OR Operation="ListItems" OR Operation="GetItem")
| eval IsAutomatedAccess=if(
    isnull(ClientInfoString) OR ClientInfoString="" OR
    match(lower(ClientInfoString), "(rest|graph|api|script|automation|curl|python|http|oauth)"),
    1, 0
  )
| where IsAutomatedAccess=1
| stats
    count as AccessCount,
    dc(ClientIP) as UniqueIPs,
    values(Operation) as Operations,
    values(ClientIP) as SourceIPs,
    earliest(_time) as FirstAccess,
    latest(_time) as LastAccess,
    dc(Operation) as OperationTypes,
    values(ClientInfoString) as ClientInfo
  by UserId, AppId
| where AccessCount > 20 OR UniqueIPs >= 2
| eval SessionDurationHours=round((LastAccess - FirstAccess) / 3600, 2)
| eval AccessRatePerHour=round(AccessCount / (SessionDurationHours + 0.001), 1)
| eval RiskScore=case(
    UniqueIPs >= 3, "HIGH",
    AccessRatePerHour > 200, "HIGH",
    UniqueIPs >= 2 AND OperationTypes >= 3, "HIGH",
    AccessCount > 100, "MEDIUM",
    UniqueIPs >= 2, "MEDIUM",
    "LOW"
  )
| where RiskScore != "LOW"
| eval FirstAccess=strftime(FirstAccess, "%Y-%m-%d %H:%M:%S")
| eval LastAccess=strftime(LastAccess, "%Y-%m-%d %H:%M:%S")
| sort - AccessCount
| table FirstAccess, LastAccess, UserId, AppId, AccessCount, UniqueIPs, AccessRatePerHour, OperationTypes, Operations, SourceIPs, ClientInfo, RiskScore

authentication where event.outcome == "success"
  and event.dataset == "azure.signinlogs"
  and azure.signinlogs.properties.is_interactive == false
  and azure.signinlogs.properties.authentication_requirement == "singleFactorAuthentication"
  and azure.signinlogs.properties.conditional_access_status in ("notApplied", "disabled", "notEnabled")
  and (
    azure.signinlogs.properties.user_agent like~ ("python-requests*", "curl/*", "wget/*", "Go-http-client*", "okhttp/*", "node-fetch*", "axios/*", "PostmanRuntime*", "libcurl*", "ruby*", "aiohttp*", "httpx*", "java/*")
    or azure.signinlogs.properties.resource_display_name in~ ("Microsoft Graph", "Office 365 Exchange Online", "SharePoint Online", "Microsoft Teams", "OneDrive", "Azure Key Vault", "Windows Azure Service Management API")
  )

/* Pair with Elastic SIEM threshold rule: group by azure.signinlogs.properties.user_principal_name,
   azure.signinlogs.properties.ip_address over 1h, alert when count >= 5 or distinct
   azure.signinlogs.properties.resource_display_name >= 3 or distinct
   azure.signinlogs.properties.ip_address >= 2 */

SELECT
  DATEFORMAT(MIN(starttime), 'YYYY-MM-dd HH:mm:ss') as FirstSeen,
  DATEFORMAT(MAX(starttime), 'YYYY-MM-dd HH:mm:ss') as LastSeen,
  username as UserId,
  "Application" as AppId,
  COUNT(*) as AccessCount,
  CARDINALITY(ARRAY_AGG(DISTINCT sourceip)) as UniqueIPs,
  ARRAY_AGG(DISTINCT sourceip LIMIT 5) as SourceIPs,
  ARRAY_AGG(DISTINCT QIDNAME(qid) LIMIT 5) as Operations,
  ARRAY_AGG(DISTINCT "User Agent" LIMIT 3) as UserAgents,
  CASE
    WHEN CARDINALITY(ARRAY_AGG(DISTINCT sourceip)) >= 3 THEN 'HIGH — token used from 3+ distinct IPs, likely stolen or shared'
    WHEN COUNT(*) > 200 AND CARDINALITY(ARRAY_AGG(DISTINCT sourceip)) >= 2 THEN 'HIGH — high-frequency scripted access from multiple IPs'
    WHEN CARDINALITY(ARRAY_AGG(DISTINCT sourceip)) >= 2 THEN 'MEDIUM — token used from multiple source IPs'
    ELSE 'LOW'
  END as RiskScore
FROM events
WHERE
  LOGSOURCETYPEID IN (397, 475)  /* 397=Microsoft Office 365, 475=Microsoft Azure Active Directory */
  AND CATEGORYNAME(category) LIKE '%Authentication%'
  AND LOWER(PROTOCOLNAME(protocolid)) != 'interactive'
  AND (
    LOWER("User Agent") MATCHES '.*(python-requests|curl\/|wget\/|go-http-client|okhttp|node-fetch|axios|postmanruntime|libcurl|ruby|aiohttp|httpx|java\/).*'
    OR "Resource Name" IN ('Microsoft Graph', 'Office 365 Exchange Online', 'SharePoint Online', 'Microsoft Teams', 'OneDrive', 'Azure Key Vault', 'Windows Azure Service Management API')
  )
  AND "Authentication Requirement" = 'singleFactorAuthentication'
  AND QIDNAME(qid) NOT LIKE '%Failed%'
  AND QIDNAME(qid) NOT LIKE '%Failure%'
  LAST 24 HOURS
GROUP BY username, "Application"
HAVING AccessCount > 10 OR UniqueIPs >= 2
ORDER BY UniqueIPs DESC, AccessCount DESC

_sourceCategory=azure/signinlogs/noninteractive OR _sourceCategory=azure/aad/signin
| json "properties.isInteractive" as IsInteractive nodrop
| json "properties.authenticationRequirement" as AuthReq nodrop
| json "properties.conditionalAccessStatus" as CAStatus nodrop
| json "properties.userAgent" as UserAgent nodrop
| json "properties.resourceDisplayName" as Resource nodrop
| json "properties.userPrincipalName" as UserPrincipalName nodrop
| json "properties.ipAddress" as IPAddress nodrop
| json "properties.appDisplayName" as AppName nodrop
| json "properties.status.errorCode" as ErrorCode nodrop
| where (IsInteractive = "false" OR isNull(IsInteractive))
  AND AuthReq = "singleFactorAuthentication"
  AND CAStatus in ("notApplied", "disabled", "notEnabled")
  AND ErrorCode = "0"
| where UserAgent matches /(?i)(python-requests|curl\/|wget\/|go-http-client|okhttp|node-fetch|axios|postmanruntime|libcurl|ruby|aiohttp|httpx|java\/)/
  OR Resource in ("Microsoft Graph", "Office 365 Exchange Online", "SharePoint Online", "Microsoft Teams", "OneDrive", "Azure Key Vault", "Windows Azure Service Management API")
| timeslice 1h
| count as TokenUseCount,
  dcount(IPAddress) as UniqueIPs,
  dcount(Resource) as UniqueResources,
  dcount(AppName) as UniqueApps,
  values(IPAddress) as SourceIPs,
  values(Resource) as ResourcesAccessed,
  values(UserAgent) as UserAgents
  by UserPrincipalName, AppName, _timeslice
| where TokenUseCount > 10 OR UniqueIPs >= 2 OR UniqueResources >= 3
| if(UniqueIPs >= 3, "HIGH", if(UniqueResources >= 5 OR TokenUseCount > 50, "MEDIUM", "LOW")) as RiskScore
| where RiskScore != "LOW"
| fields _timeslice, UserPrincipalName, AppName, TokenUseCount, UniqueIPs, UniqueResources, UniqueApps, SourceIPs, ResourcesAccessed, UserAgents, RiskScore
| sort by TokenUseCount desc

rule t1550_001_application_access_token_abuse {
  meta:
    author = "df00tech"
    description = "Detects stolen OAuth application access token abuse via non-interactive single-factor authentication to sensitive Microsoft cloud resources from automated HTTP clients"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Defense Evasion, Lateral Movement"
    mitre_attack_technique = "T1550.001"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1550/001/"
    reference = "APT28 OAuth phishing, HAFNIUM token theft, Peirates Kubernetes service account token abuse"
    version = "1.0"

  events:
    $auth.metadata.event_type = "USER_LOGIN"
    $auth.metadata.product_name = "Azure Active Directory"
    $auth.extensions.auth.auth_details = "NonInteractive"
    $auth.security_result.action = "ALLOW"
    (
      re.regex($auth.network.http.user_agent,
        `(?i)(python-requests|curl/|wget/|go-http-client|okhttp/|node-fetch|axios/|postmanruntime|libcurl|ruby|aiohttp|httpx|java/)`)
      or $auth.target.application.asset_id in (
        "Microsoft Graph",
        "Office 365 Exchange Online",
        "SharePoint Online",
        "Microsoft Teams",
        "OneDrive",
        "Azure Key Vault",
        "Windows Azure Service Management API"
      )
    )
    $auth.extensions.auth.mechanism != "MECHANISM_UNSPECIFIED"
    not $auth.extensions.auth.auth_details = "Interactive"
    $auth.principal.user.email_addresses = $user
    $auth.principal.ip = $src_ip

  match:
    $user over 1h

  outcome:
    $risk_score = max(
      if(#auth > 50, 95,
      if(#auth > 20, 80,
      if(#auth > 10, 65, 50)))
    )
    $token_use_count = count_distinct($auth.metadata.id)
    $unique_ips = count_distinct($src_ip)
    $resources_accessed = array_distinct($auth.target.application.asset_id)
    $user_agents = array_distinct($auth.network.http.user_agent)
    $source_ips = array_distinct($src_ip)

  condition:
    #auth > 10 or count_distinct($src_ip) >= 2
}

// CrowdStrike Falcon — OAuth token abuse via endpoint process behavior
// Detects processes making automated API calls to Microsoft identity and cloud endpoints
// which is the endpoint manifestation of T1550.001 token theft and replay

#event_simpleName = "ProcessRollup2"
| CommandLine = /(?i)(graph\.microsoft\.com|login\.microsoftonline\.com|outlook\.office365\.com|sharepoint\.com|vault\.azure\.net)/
| CommandLine = /(?i)(bearer|access_token|oauth|Authorization:|--header|curl|wget|python|invoke-webrequest|invoke-restmethod)/
| case {
    ImageFileName = /(?i)(\\python[0-9]*\.exe|\\curl\.exe|\\wget\.exe|\\powershell\.exe|\\pwsh\.exe)/ |
      ToolCategory := "Known HTTP tool" ;
    CommandLine = /(?i)(invoke-restmethod|invoke-webrequest|\$headers|bearer)/ |
      ToolCategory := "PowerShell API call" ;
    CommandLine = /(?i)(curl|wget|http\.get|requests\.get|fetch\()/ |
      ToolCategory := "Script HTTP client" ;
    * | ToolCategory := "Other"
  }
| groupBy(
    [ComputerName, UserName, ImageFileName, ToolCategory],
    function=[
      count(as=ApiCallCount),
      collect(field=CommandLine, limit=5, as=CommandSamples),
      min(field=@timestamp, as=FirstSeen),
      max(field=@timestamp, as=LastSeen),
      count(field=TargetProcessId, distinct=true, as=UniqueProcessInstances)
    ]
  )
| ApiCallCount > 10
| sort(ApiCallCount, order=desc)
| select([ComputerName, UserName, ImageFileName, ToolCategory, ApiCallCount, UniqueProcessInstances, CommandSamples, FirstSeen, LastSeen])

/* SUPPLEMENTAL: Hunt for credential/token files accessed before API calls */
// #event_simpleName = "MotionDetected"
// | TargetFileName = /(?i)(\.token|\.json|access_token|refresh_token|credential|\bauth\b)/
// | groupBy([ComputerName, UserName, TargetFileName], function=count(as=AccessCount))
// | AccessCount > 3