IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Microsoft 365 OAuth Phishing via Visual Studio Code Client Microsoft 365 Potential ransomware activity »
Elastic Docs ›Elastic Security [8.18] ›Detections and alerts ›Prebuilt rule reference

Microsoft 365 OAuth Redirect to Device Registration for User Principal

edit
A newer version is available. Check out the latest documentation.

Microsoft 365 OAuth Redirect to Device Registration for User Principal

edit

Identifies attempts to register a new device in Microsoft Entra ID after OAuth authentication with authorization code grant. Adversaries may use OAuth phishing techniques to obtain an OAuth authorization code, which can then be exchanged for access and refresh tokens. This rule detects a sequence of events where a user principal authenticates via OAuth, followed by a device registration event, indicating potential misuse of the OAuth flow to establish persistence or access resources.

Rule type: eql

Rule indices:

  • filebeat-*
  • logs-o365.audit-*

Severity: high

Risk score: 73

Runs every: 15m

Searches indices from: now-30m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Domain: SaaS
  • Data Source: Microsoft 365
  • Data Source: Microsoft 365 Audit Logs
  • Use Case: Identity and Access Audit
  • Tactic: Credential Access
  • Resources: Investigation Guide

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Microsoft 365 OAuth Redirect to Device Registration for User Principal

Possible investigation steps

  • Review the two UserLoggedIn logs to confirm that they come from different source.ip values and are associated to the same account.
  • Verify all events associated to the source.ip of the the second event in the sequence.
  • Investiguate the details of the new device that was added by reviewing the o365.audit.ModifiedProperties.Device_DisplayName.NewValue attribute.
  • Investigate the user account associated with the successful sign-in to determine if this activity aligns with expected behavior or if it appears suspicious.
  • Review the history of sign-ins for the user to identify any patterns or unusual access times that could suggest unauthorized access.
  • Assess the device from which the sign-in was attempted to ensure it is a recognized and authorized device for the user.

False positive analysis

  • Both authentcation events of the sequence are originatng from the same source.ip.
  • User using multiple devices and attempted to add a new device post an OAuth code authentication.

Response and remediation

  • Immediately revoke the compromised Primary Refresh Tokens (PRTs) to prevent further unauthorized access. This can be done through the Azure portal by navigating to the user’s account and invalidating all active sessions.
  • Enforce a password reset for the affected user accounts to ensure that any credentials potentially compromised during the attack are no longer valid.
  • Implement additional Conditional Access policies that require device compliance checks and restrict access to trusted locations or devices only, to mitigate the risk of future PRT abuse.
  • Conduct a thorough review of the affected accounts' recent activity logs to identify any unauthorized actions or data access that may have occurred during the compromise.
  • Escalate the incident to the security operations team for further investigation and to determine if there are any broader implications or additional compromised accounts.
  • Enhance monitoring by configuring alerts for unusual sign-in patterns or device code authentication attempts from unexpected locations or devices, to improve early detection of similar threats.
  • Coordinate with the incident response team to perform a post-incident analysis and update the incident response plan with lessons learned from this event.

Rule query

edit
sequence by related.user with maxspan=30m
[authentication where event.action == "UserLoggedIn" and
 o365.audit.ExtendedProperties.RequestType == "OAuth2:Authorize" and o365.audit.ExtendedProperties.ResultStatusDetail == "Redirect" and
 o365.audit.UserType: ("0", "2", "3", "10")] // victim source.ip
[authentication where event.action == "UserLoggedIn" and
 o365.audit.ExtendedProperties.RequestType == "OAuth2:Token" and o365.audit.ExtendedProperties.ResultStatusDetail == "Success"] // attacker source.ip to convert oauth code to token
[web where event.dataset == "o365.audit" and event.action == "Add registered users to device."] // user.name is captured in related.user

Framework: MITRE ATT&CKTM

« Microsoft 365 OAuth Phishing via Visual Studio Code Client Microsoft 365 Potential ransomware activity »