a user who runs azure cli, azure powershell, vs code, graph cli, or visual studio from a new egress (vpn, hotel, cloud shell, jump host) while wam still attaches a compliant or managed workstation deviceid will match on first sight of that ip. exception: add known developer and cloud shell ranges after confirming the client ran there.

Techniques

Sample rules

Entra ID Device-Bound PRT from Unusual Device IP

source: elastic
technicques:
- T1078
- T1528
- T1539
- T1550

Description

Detects a first-party FOCI tooling client (Azure CLI, PowerShell, VS Code, Graph CLI, Azure AD PowerShell, or Visual Studio) redeeming a device-bound Primary Refresh Token (PRT) for Microsoft Graph, SharePoint/OneDrive, or Exchange Online from a source IP that has not been seen with that deviceid. Replay events are limited to compliant or Intune-managed devices. Adversaries who steal a WAM PRT SSO cookie replay it off-box; the token keeps the workstation deviceid, so this pair is new even when Windows Sign-In for that device is outside a correlation window.

Detection logic

data_stream.dataset: azure.signinlogs and
    event.outcome: success and
    azure.signinlogs.properties.status.error_code: 0 and
    azure.signinlogs.properties.incoming_token_type: "primaryRefreshToken" and
    azure.signinlogs.properties.device_detail.device_id: * and
    source.ip: * and
    (
        azure.signinlogs.properties.device_detail.is_compliant: true or
        azure.signinlogs.properties.device_detail.is_managed: true
    ) and azure.signinlogs.properties.app_id: (
        "04b07795-8ddb-461a-bbee-02f9e1bf7b46" or
        "1950a258-227b-4e31-a9cf-717495945fc2" or
        "aebc6443-996d-45c2-90f0-388ff96faa56" or
        "14d82eec-204b-4c2f-b7e8-296a70dab67e" or
        "1b730954-1685-4b74-9bfd-dac224a7b894" or
        "872cd9fa-d31f-45e0-9eab-6e460a02d1f1"
    ) and azure.signinlogs.properties.resource_id: (
        "00000003-0000-0000-c000-000000000000" or
        "00000003-0000-0ff1-ce00-000000000000" or
        "6a9b9266-8161-4a7b-913a-a9eda19da220" or
        "00000002-0000-0ff1-ce00-000000000000"
    )