seikaikyo/hunting-saas-sso-token-abuse

Hunting SaaS SSO Token Abuse

Overview

Adversaries increasingly bypass MFA not by defeating it but by stealing the artifacts issued after a successful authentication — session cookies, OAuth access/refresh tokens, and Primary Refresh Tokens (PRTs). With a stolen token an attacker replays the existing session ("pass-the-cookie" / token replay), inheriting the victim's authenticated state across federated SaaS without ever prompting for credentials or MFA. Mandiant's M-Trends reporting and Microsoft/Okta incident data both highlight token theft as a dominant cloud lateral-movement technique, mapped to MITRE ATT&CK T1550.001 Use Alternate Authentication Material: Application Access Token.

Detection relies on correlating identity telemetry rather than watching for failed logins. In Microsoft Entra ID the key tables are SigninLogs (interactive), AADNonInteractiveUserSignInLogs (where replayed cookies/refresh tokens commonly surface), and AADServicePrincipalSignInLogs. Entra now exposes linkable identifiers — SessionId and UniqueTokenIdentifier — that let a hunter stitch every artifact derived from one root authentication event together and spot a single session being used from multiple IPs, ASNs, or device fingerprints. In Okta the System Log carries authentication.sso, policy.evaluate_sign_on, and user.session.start events with a deviceToken/session context; the same session token appearing from divergent IPs/user-agents is the tell. Okta Identity Threat Protection (ITP) can natively flag "suspected session hijacking."

This skill provides a hypothesis-driven hunt: baseline normal session behavior, then look for impossible travel within a single session, refresh-token reuse, token use from anomalous infrastructure (hosting/VPS ASNs), and SaaS access patterns inconsistent with the user's device. Source: MITRE ATT&CK T1550.001; Microsoft Entra ID sign-in log documentation; Okta System Log reference; Mandiant M-Trends.

When to Use

• Threat hunting for MFA-bypass via stolen tokens/cookies across Entra ID and SaaS
• Investigating an alert for impossible travel, anomalous OAuth grant, or token reuse
• Validating detection coverage for T1550.001 after a phishing/AiTM incident
• Building Sentinel/Splunk/Okta detections for session-token replay
• Post-incident hunting to scope SaaS lateral movement from a compromised identity

Prerequisites

• Entra ID sign-in logs flowing to a queryable store (Microsoft Sentinel / Log Analytics):

  # Confirm the diagnostic settings export SigninLogs + non-interactive logs to a workspace
  az monitor diagnostic-settings list --resource \
    /providers/Microsoft.aadiam/diagnosticSettings -o table
  

• Okta System Log access via API or SIEM ingestion:

  curl -s -H "Authorization: SSWS $OKTA_API_TOKEN" \
    "https://<org>.okta.com/api/v1/logs?filter=eventType eq \"user.session.start\"&since=2026-06-01T00:00:00Z"
  

• An IP enrichment source (GeoIP + ASN/hosting-provider classification)
• Read access to the SIEM (KQL for Sentinel, SPL for Splunk)
• Python 3.9+ for the helper script (requests for the Okta API)

Objectives

• Baseline normal per-user session behavior (IPs, ASNs, devices, SaaS apps)
• Correlate Entra sign-in artifacts by SessionId / UniqueTokenIdentifier
• Detect a single session used from multiple IPs/ASNs (token replay)
• Detect impossible travel within one authenticated session
• Detect refresh-token reuse and anomalous OAuth grants
• Hunt Okta System Log for reused session tokens across contexts
• Produce findings and feed confirmed patterns into standing detections

MITRE ATT&CK Mapping

| ID | Name | Use in this skill | |----|------|-------------------| | T1550.001 | Use Alternate Authentication Material: Application Access Token | Core technique — replaying stolen OAuth tokens/cookies | | T1539 | Steal Web Session Cookie | The cookie theft that precedes pass-the-cookie replay | | T1528 | Steal Application Access Token | Acquisition of OAuth tokens via phishing/illicit consent | | T1078.004 | Valid Accounts: Cloud Accounts | Replayed tokens grant valid-account access to SaaS | | T1098.001 | Account Manipulation: Additional Cloud Credentials | Follow-on persistence after token abuse |

Workflow

1. Correlate Entra sign-in artifacts by session

Stitch interactive, non-interactive, and SP sign-ins for one session to see the full chain.

union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(7d)
| where isnotempty(SessionId)
| summarize IPs=make_set(IPAddress), Apps=make_set(AppDisplayName),
            Locations=make_set(tostring(LocationDetails.countryOrRegion)),
            Count=count() by SessionId, UserPrincipalName
| where array_length(IPs) > 1

2. Detect a single session used from multiple ASNs (token replay)

AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| extend ASN = tostring(parse_json(tostring(NetworkLocationDetails))[0].networkType)
| summarize distinctIPs = dcount(IPAddress),
            ipset = make_set(IPAddress) by SessionId, UserPrincipalName
| where distinctIPs >= 2

3. Detect impossible travel within one authenticated session

SigninLogs
| where TimeGenerated > ago(7d)
| project TimeGenerated, UserPrincipalName, IPAddress,
          City=tostring(LocationDetails.city),
          Country=tostring(LocationDetails.countryOrRegion), SessionId
| order by UserPrincipalName, TimeGenerated asc
| serialize
| extend prevCountry = prev(Country), prevTime = prev(TimeGenerated),
         prevUser = prev(UserPrincipalName)
| where UserPrincipalName == prevUser and Country != prevCountry
        and datetime_diff('minute', TimeGenerated, prevTime) < 60

4. Detect token use from hosting/VPS infrastructure

Replayed tokens are frequently used from datacenter ASNs, unlike the user's residential/corporate ranges.

AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| extend asnOrg = tostring(parse_json(tostring(AutonomousSystemNumber)))
| where IPAddress in (toscalar(externaldata(ip:string)["<hosting-asn-iplist>"]))
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress

5. Hunt anomalous OAuth grants / illicit consent (token theft precursor)

AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName in ("Consent to application", "Add OAuth2PermissionGrant",
                          "Add delegated permission grant")
| extend app = tostring(TargetResources[0].displayName)
| project TimeGenerated, InitiatedBy, app, Result

6. Hunt the Okta System Log for reused session tokens

A single Okta session (deviceToken) used from divergent IPs/clients indicates hijack.

curl -s -H "Authorization: SSWS $OKTA_API_TOKEN" \
  "https://<org>.okta.com/api/v1/logs?filter=eventType eq \"policy.evaluate_sign_on\"&since=2026-06-15T00:00:00Z" \
  | jq -r '.[] | [.authenticationContext.externalSessionId, .client.ipAddress, .client.userAgent.rawUserAgent] | @tsv' \
  | sort | uniq -c | sort -rn

7. Splunk equivalent for Okta session reuse

index=okta eventType="policy.evaluate_sign_on"
| stats dc(client.ipAddress) as ip_count
        values(client.ipAddress) as ips
        values(client.userAgent.rawUserAgent) as agents
        by authenticationContext.externalSessionId actor.alternateId
| where ip_count > 1

8. Triage and respond

For confirmed token abuse, revoke sessions and rotate, then promote the hunt to a rule.

# Revoke all refresh tokens / sessions for the user in Entra
az rest --method POST \
  --url "https://graph.microsoft.com/v1.0/users/<userId>/revokeSignInSessions"

See scripts/agent.py to pull Okta logs and flag reused session tokens automatically.

Tools and Resources

| Resource | Purpose | Link | |----------|---------|------| | MITRE ATT&CK T1550.001 | Technique reference | https://attack.mitre.org/techniques/T1550/001/ | | Entra sign-in logs schema | KQL hunting field reference | https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-azure-monitor-sign-ins-log-schema | | Azure-Sentinel hunting repo | Community KQL detections | https://github.com/Azure/Azure-Sentinel | | Okta System Log API | Event hunting source | https://developer.okta.com/docs/reference/api/system-log/ | | Mandiant M-Trends | Token-theft threat landscape | https://www.mandiant.com/m-trends | | AzureAD-Attack-Defense | PRT/token replay detection guidance | https://github.com/Cloud-Architekt/AzureAD-Attack-Defense |

Preventive Controls to Recommend

Detection should pair with controls that make stolen tokens far less useful:

• Entra Conditional Access "token protection" binds the sign-in session to the device, so an exfiltrated cookie/PRT cannot be replayed off-device.
• Continuous Access Evaluation (CAE) revokes access in near-real-time on risk events instead of waiting for token expiry.
• Phishing-resistant MFA (FIDO2/passkeys) blocks the AiTM proxy phishing that harvests tokens in the first place.
• Short token lifetimes + refresh-token rotation shrink the replay window and turn refresh-token reuse into an unambiguous compromise signal.
• Okta Identity Threat Protection (ITP) flags suspected session hijacking natively.

False-Positive Tuning

| Benign cause | Tuning | |--------------|--------| | Corporate VPN/proxy egress (many users, few IPs) | Allowlist known egress IPs/ASNs | | Mobile carrier IP rotation | Widen impossible-travel time/distance thresholds | | Legitimate multi-device users | Correlate device IDs, not just IPs | | Backend/API calls within one session | Exclude expected service principals |

Key Indicators

| Indicator | Signal | |-----------|--------| | One SessionId across multiple IPs/ASNs | Token/cookie replay | | Non-interactive sign-in from new datacenter IP | Replayed refresh token | | Impossible travel within < 1h | Concurrent session use | | Refresh-token reuse after rotation | Strong compromise signal | | New OAuth consent to unfamiliar app | Illicit-consent token theft | | Okta session token from divergent user-agents | Session hijack |

Validation Criteria

• [ ] Entra SigninLogs and AADNonInteractiveUserSignInLogs queryable
• [ ] Okta System Log accessible via API or SIEM
• [ ] Per-session correlation by SessionId produces results
• [ ] Multi-IP / multi-ASN single-session query implemented
• [ ] Impossible-travel-within-session query implemented
• [ ] Anomalous OAuth consent hunt implemented
• [ ] Okta reused-session-token hunt implemented
• [ ] Confirmed findings triaged and sessions revoked
• [ ] Effective queries promoted to standing detection rules
• [ ] False-positive baseline (VPN/proxy egress) documented