Detecting OAuth Token Theft

When to Use

• Investigating alerts for impossible travel or anomalous token usage in Microsoft Entra ID
• Responding to a suspected session hijacking or pass-the-cookie attack
• Configuring proactive defenses against OAuth token theft in an Azure/M365 environment
• Detecting OAuth device code phishing campaigns that bypass MFA
• Analyzing sign-in logs for token replay indicators
• Implementing Token Protection conditional access policies to bind tokens to devices

Do not use for on-premises Kerberos ticket attacks (pass-the-ticket, golden ticket); use Active Directory-specific investigation techniques for those scenarios.

Prerequisites

• Microsoft Entra ID P2 license (required for Identity Protection risk detections and conditional access)
• Global Administrator or Security Administrator role in the Entra admin center
• Microsoft Defender for Cloud Apps (MDCA) license for session anomaly detection
• Access to Entra ID Sign-in Logs and Audit Logs (requires Diagnostic Settings configured to Log Analytics or Sentinel)
• Familiarity with OAuth 2.0 authorization flows (authorization code, device code, client credentials)
• Microsoft Sentinel or equivalent SIEM ingesting Entra ID sign-in and audit logs

Workflow

Step 1: Understand the Token Theft Attack Surface

Identify which token types are at risk and how they are stolen:

Token Type            | Lifetime     | Theft Vector                    | Impact
----------------------|-------------|----------------------------------|------------------
Access Token          | 60-90 min   | Memory dump, proxy interception  | API access for token lifetime
Refresh Token         | Up to 90 days| Browser cookie theft, malware   | Persistent access, new access tokens
Primary Refresh Token | Session-based| Mimikatz, AADInternals, malware | Full SSO to all M365/Azure apps
Session Cookie        | Varies      | XSS, browser exploit, AitM proxy | Full session hijacking
Device Code Token     | 15 min auth | Phishing (device code flow abuse)| Attacker gets refresh token via social engineering

Common attack techniques:

• AitM Phishing (Adversary-in-the-Middle): Attacker proxies the legitimate login page via tools like Evilginx2, capturing session cookies and tokens after the user completes MFA
• Device Code Phishing: Attacker generates a device code, sends it to the victim via email/Teams, victim authenticates, attacker receives the token
• PRT Extraction: Attacker with local admin on a device extracts the Primary Refresh Token using Mimikatz (sekurlsa::cloudap) or AADInternals
• Browser Cookie Theft: Malware or infostealer exfiltrates browser cookies containing session tokens

Step 2: Configure Entra ID Sign-in Risk Detection

Enable Identity Protection to flag anomalous token usage:

Entra Admin Center > Protection > Identity Protection > Risk Detections

Key risk detections for token theft:
- Anomalous Token        : Token has unusual characteristics (claim anomalies)
- Token Issuer Anomaly   : Token issued by an unusual token issuer
- Unfamiliar Sign-in     : Sign-in from a location not seen before for the user
- Impossible Travel      : Sign-ins from geographically distant locations in impossible time
- Malicious IP Address   : Sign-in from a known malicious IP
- Suspicious Browser     : Sign-in from a suspicious or attacker-controlled browser

Configure risk-based conditional access:

Entra Admin Center > Protection > Conditional Access > New Policy

Policy Name: "Block High-Risk Sign-ins - Token Theft Protection"
Assignments:
  Users: All users (exclude break-glass accounts)
  Cloud Apps: All cloud apps
Conditions:
  Sign-in Risk: High
Grant:
  Block access

Policy Name: "Require MFA for Medium-Risk Sign-ins"
Assignments:
  Users: All users
  Cloud Apps: All cloud apps
Conditions:
  Sign-in Risk: Medium
Grant:
  Require multifactor authentication
  Require password change

Step 3: Enable Token Protection (Preview)

Configure Token Protection to bind sign-in session tokens to the device:

Entra Admin Center > Protection > Conditional Access > New Policy

Policy Name: "Enforce Token Protection for Desktop Sessions"
Assignments:
  Users: All users (start with a pilot group)
  Cloud Apps: Office 365 Exchange Online, Office 365 SharePoint Online
  Conditions:
    Device Platforms: Windows
Session:
  Require token protection for sign-in sessions (Preview): Enabled
Grant:

…