Terrance DeJesus
Verified account This account is verified. Learn more@_xDeJesus
$ Security Researcher // Cloud & Identity
{HUmar Skyly // Professional Hogger Hunter}
{Opinions are my Own}
{HUmar Skyly // Professional Hogger Hunter}
{Opinions are my Own}
1.3K Following 954 Followers 3.4K Posts
Latest posts 5
Great work from @HuntressLabs regarding the token play activity. Validated we are seeing as well. They shared all the right observables and signals for detections/hunting. Reminder to check UAL too, not only Entra ID logs.
ref: huntress.com/blog/token-rep…
ref: huntress.com/blog/token-rep…
www.huntress.com M365 Token Spray and Replay Campaign Compromises Business Email Accounts | Huntress Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules. This is where detection is challenging. Benign everything outside the Android device itself.
- app ID is first party
- resource ID (Graph)
- .default for Graph (delegated scopes for first party app)
- legit UPN (authenticated user)
- source ASN/IP is expected and matches user
- device is likely compliant/enrolled in MDM because it's the users)
enclave.ai/blog/authmask-…
- app ID is first party
- resource ID (Graph)
- .default for Graph (delegated scopes for first party app)
- legit UPN (authenticated user)
- source ASN/IP is expected and matches user
- device is likely compliant/enrolled in MDM because it's the users)
enclave.ai/blog/authmask-…
enclave.ai Enclave: AuthMask: We Made Microsoft Authenticator Hand Over Tokens to an App With Zero Permissions How one exported activity in Microsoft Authenticator let an unprivileged app get tokens for any Microsoft service. Agent -> “cmsi:cmsi seems great to ignore to reduce false positives.” IYKYK
askWAM is a pretty neat tool. Still playing around with it. --> github.com/dirkjanm/askWAM
Detection from Entra ID Sign-In logs is challenging. Incoming token already exists unless issuance is new via refresh or PRT, session ID already existed and client app for OAuth is first-party. Considering the binary is targeted to a victim endpoint, geolocation data doesn't help either unless the token is take offline, but wth the CS implant its unlikely. Not to mention that endpoint is likely already enrolled in Intune and compliant - victim user's authenticated session means no fuss about MFA and CAP checks again.
You can coalesce linkable identifiers between sign-in & Graph activity logs, filtering on plausible enumeration endpoints, but its still a mid detection. --> github.com/elastic/detect…
Endpoint side, unusual processes (no sig, proxied through rundll or PS and "windows[dot]security.authentication.web.core.dll" in the call stack) opening Token Broker cache files seems to be a good signal to start as shown in the image. Can build on this with specific path exclusions too.
Still plenty of digging to do. Happy hunting!
Detection from Entra ID Sign-In logs is challenging. Incoming token already exists unless issuance is new via refresh or PRT, session ID already existed and client app for OAuth is first-party. Considering the binary is targeted to a victim endpoint, geolocation data doesn't help either unless the token is take offline, but wth the CS implant its unlikely. Not to mention that endpoint is likely already enrolled in Intune and compliant - victim user's authenticated session means no fuss about MFA and CAP checks again.
You can coalesce linkable identifiers between sign-in & Graph activity logs, filtering on plausible enumeration endpoints, but its still a mid detection. --> github.com/elastic/detect…
Endpoint side, unusual processes (no sig, proxied through rundll or PS and "windows[dot]security.authentication.web.core.dll" in the call stack) opening Token Broker cache files seems to be a good signal to start as shown in the image. Can build on this with specific path exclusions too.
Still plenty of digging to do. Happy hunting!
