Detect Application Access Token in IBM QRadar
Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud and SaaS environments. Stolen OAuth tokens can grant long-term access to resources — including email, files, and cloud infrastructure — without requiring the original user credentials. Token-based API access bypasses MFA controls entirely and may persist even after password resets, since token validity is independent of the user's password. Adversaries exploit this in Microsoft 365 environments via OAuth phishing (APT28, HAFNIUM), in AWS via STS federation token generation, and in Kubernetes via stolen service account tokens (Peirates).
MITRE ATT&CK
- Tactic
- Defense Evasion Lateral Movement
- Sub-technique
- T1550.001 Application Access Token
- Canonical reference
- https://attack.mitre.org/techniques/T1550/001/
QRadar Detection Query
SELECT
DATEFORMAT(MIN(starttime), 'YYYY-MM-dd HH:mm:ss') as FirstSeen,
DATEFORMAT(MAX(starttime), 'YYYY-MM-dd HH:mm:ss') as LastSeen,
username as UserId,
"Application" as AppId,
COUNT(*) as AccessCount,
CARDINALITY(ARRAY_AGG(DISTINCT sourceip)) as UniqueIPs,
ARRAY_AGG(DISTINCT sourceip LIMIT 5) as SourceIPs,
ARRAY_AGG(DISTINCT QIDNAME(qid) LIMIT 5) as Operations,
ARRAY_AGG(DISTINCT "User Agent" LIMIT 3) as UserAgents,
CASE
WHEN CARDINALITY(ARRAY_AGG(DISTINCT sourceip)) >= 3 THEN 'HIGH — token used from 3+ distinct IPs, likely stolen or shared'
WHEN COUNT(*) > 200 AND CARDINALITY(ARRAY_AGG(DISTINCT sourceip)) >= 2 THEN 'HIGH — high-frequency scripted access from multiple IPs'
WHEN CARDINALITY(ARRAY_AGG(DISTINCT sourceip)) >= 2 THEN 'MEDIUM — token used from multiple source IPs'
ELSE 'LOW'
END as RiskScore
FROM events
WHERE
LOGSOURCETYPEID IN (397, 475) /* 397=Microsoft Office 365, 475=Microsoft Azure Active Directory */
AND CATEGORYNAME(category) LIKE '%Authentication%'
AND LOWER(PROTOCOLNAME(protocolid)) != 'interactive'
AND (
LOWER("User Agent") MATCHES '.*(python-requests|curl\/|wget\/|go-http-client|okhttp|node-fetch|axios|postmanruntime|libcurl|ruby|aiohttp|httpx|java\/).*'
OR "Resource Name" IN ('Microsoft Graph', 'Office 365 Exchange Online', 'SharePoint Online', 'Microsoft Teams', 'OneDrive', 'Azure Key Vault', 'Windows Azure Service Management API')
)
AND "Authentication Requirement" = 'singleFactorAuthentication'
AND QIDNAME(qid) NOT LIKE '%Failed%'
AND QIDNAME(qid) NOT LIKE '%Failure%'
LAST 24 HOURS
GROUP BY username, "Application"
HAVING AccessCount > 10 OR UniqueIPs >= 2
ORDER BY UniqueIPs DESC, AccessCount DESCDetects OAuth application access token abuse in Microsoft 365 and Azure AD environments by correlating non-interactive single-factor authentications from automated HTTP clients or targeting sensitive cloud resources. High UniqueIPs for a single user-application pair is the strongest signal of a stolen token being used from attacker infrastructure. Requires QRadar DSMs for Microsoft Office 365 (log source type 397) and/or Microsoft Azure Active Directory (475) with proper field extraction for User Agent and Resource Name.
Data Sources
Required Tables
False Positives & Tuning
- Automated backup or archival services (Veeam, AvePoint, Druva) that authenticate to Exchange Online and SharePoint using service principal tokens at high frequency during scheduled backup windows
- Third-party SaaS integrations (Salesforce, ServiceNow, Workday) configured to sync with Microsoft 365 using OAuth app registrations, generating batched API calls from their cloud infrastructure IPs
- Security scanning tools and CASB solutions (Microsoft Defender for Cloud Apps, Netskope) that enumerate Microsoft Graph endpoints using delegated tokens to assess data exposure
Other platforms for T1550.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1OAuth Refresh Token Exchange for Microsoft Graph Access Token
Expected signal: AADNonInteractiveUserSignInLogs entry: ResultType=0, AuthenticationRequirement=singleFactorAuthentication, ClientAppUsed=MSAL (or legacy), AppId matching CLIENT_ID, ResourceDisplayName=Microsoft Graph. The user-agent will be curl/x.x.x, triggering the HasSuspiciousAgent filter.
- Test 2Microsoft Graph API Mailbox Enumeration Using Stolen Bearer Token
Expected signal: Microsoft 365 Unified Audit Log: MailItemsAccessed and MessageBind operations generated per message accessed; FileAccessed for drive enumeration — all attributed to the AppId that issued the token. AADNonInteractiveUserSignInLogs shows a non-interactive sign-in for Microsoft Graph resource with AuthenticationRequirement=singleFactorAuthentication.
- Test 3AWS STS GetFederationToken for Persistent Secondary Credential
Expected signal: AWS CloudTrail event: eventName=GetFederationToken, eventSource=sts.amazonaws.com, userIdentity.type=IAMUser, requestParameters.name=df00tech-test-session. Subsequent GetCallerIdentity shows userIdentity.type=FederatedUser, confirming token independence.
- Test 4Kubernetes Service Account Token Lateral Movement
Expected signal: Kubernetes API server audit log: authentication events with userInfo.username=system:serviceaccount:<namespace>:<serviceaccount>, verb=list, resource=secrets, namespace=<namespace>. Cross-namespace kube-system access attempt appears as a separate event with responseStatus.code=403 (if RBAC is properly configured). In EKS, AKS, and GKE these events appear in CloudTrail, Azure Monitor, and Cloud Audit Logs respectively.
References (12)
- https://attack.mitre.org/techniques/T1550/001/
- https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens
- https://learn.microsoft.com/en-us/azure/active-directory/develop/refresh-tokens
- https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-mailitemsaccessed
- https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html
- https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/
- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
- https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/
- https://www.microsoft.com/en-us/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/
- https://github.com/dafthack/GraphRunner
- https://github.com/mandiant/Mandiant-Azure-AD-Investigator
- https://github.com/inguardians/peirates
Unlock Pro Content
Get the full detection package for T1550.001 including response playbook, investigation guide, and atomic red team tests.