detecting-oauth-token-theft

检测 OAuth 令牌窃取

何时使用

• 调查 Microsoft Entra ID 中不可能的旅行或异常令牌使用告警
• 响应疑似会话劫持或 pass-the-cookie 攻击
• 在 Azure/M365 环境中配置针对 OAuth 令牌窃取的主动防御
• 检测绕过 MFA 的 OAuth 设备代码钓鱼活动
• 分析登录日志中的令牌重放指标
• 实施令牌保护条件访问策略，将令牌绑定到设备

请勿使用于本地 Kerberos 票据攻击（pass-the-ticket、golden ticket）；这些场景请使用 Active Directory 专用调查技术。

先决条件

• Microsoft Entra ID P2 许可证（Identity Protection 风险检测和条件访问所需）
• Entra 管理中心中的全局管理员或安全管理员角色
• Microsoft Defender for Cloud Apps (MDCA) 许可证，用于会话异常检测
• 对 Entra ID 登录日志和审核日志的访问权限（需要将诊断设置配置到 Log Analytics 或 Sentinel）
• 熟悉 OAuth 2.0 授权流程（授权代码、设备代码、客户端凭据）
• Microsoft Sentinel 或同等 SIEM 正在摄取 Entra ID 登录和审核日志

工作流

步骤 1：了解令牌窃取攻击面

确定哪些令牌类型存在风险以及它们是如何被窃取的：

Token Type            | Lifetime     | Theft Vector                    | Impact
----------------------|-------------|----------------------------------|------------------
Access Token          | 60-90 min   | Memory dump, proxy interception  | API access for token lifetime
Refresh Token         | Up to 90 days| Browser cookie theft, malware   | Persistent access, new access tokens
Primary Refresh Token | Session-based| Mimikatz, AADInternals, malware | Full SSO to all M365/Azure apps
Session Cookie        | Varies      | XSS, browser exploit, AitM proxy | Full session hijacking
Device Code Token     | 15 min auth | Phishing (device code flow abuse)| Attacker gets refresh token via social engineering

常见攻击技术：

• AitM 钓鱼（中间人攻击）：攻击者通过 Evilginx2 等工具代理合法登录页面，在用户完成 MFA 后捕获会话 cookie 和令牌
• 设备代码钓鱼：攻击者生成设备代码，通过电子邮件/Teams 发送给受害者，受害者进行身份验证，攻击者收到令牌
• PRT 提取：拥有设备本地管理员权限的攻击者使用 Mimikatz（sekurlsa::cloudap）或 AADInternals 提取主刷新令牌
• 浏览器 Cookie 窃取：恶意软件或信息窃取程序外泄包含会话令牌的浏览器 cookie

步骤 2：配置 Entra ID 登录风险检测

启用 Identity Protection 以标记异常令牌使用：

Entra Admin Center > Protection > Identity Protection > Risk Detections

Key risk detections for token theft:
- Anomalous Token        : Token has unusual characteristics (claim anomalies)
- Token Issuer Anomaly   : Token issued by an unusual token issuer
- Unfamiliar Sign-in     : Sign-in from a location not seen before for the user
- Impossible Travel      : Sign-ins from geographically distant locations in impossible time
- Malicious IP Address   : Sign-in from a known malicious IP
- Suspicious Browser     : Sign-in from a suspicious or attacker-controlled browser

配置基于风险的条件访问：

Entra Admin Center > Protection > Conditional Access > New Policy

Policy Name: "Block High-Risk Sign-ins - Token Theft Protection"
Assignments:
  Users: All users (exclude break-glass accounts)
  Cloud Apps: All cloud apps
Conditions:
  Sign-in Risk: High
Grant:
  Block access

Policy Name: "Require MFA for Medium-Risk Sign-ins"
Assignments:
  Users: All users
  Cloud Apps: All cloud apps
Conditions:
  Sign-in Risk: Medium
Grant:
  Require multifactor authentication
  Require password change

步骤 3：启用令牌保护（预览版）

配置令牌保护以将登录会话令牌绑定到设备：

Entra Admin Center > Protection > Conditional Access > New Policy

Policy Name: "Enforce Token Protection for Desktop Sessions"
Assignments:
  Users: All users (start with a pilot group)
  Cloud Apps: Office 365 Exchange Online, Office 365 SharePoint Online
  Conditions:
    Device Platforms: Windows
Session:
  Require token protection for sign-in sessions (Preview): Enabled
Grant:
  Require device to be marked as compliant
  OR Require Hybrid Azure AD joined device

令牌保护确保访问令牌以加密方式绑定到设备的可信平台模块 (TPM)。如果攻击者窃取令牌并从其他设备重放，令牌将被拒绝，因为持有证明密钥不匹配。

步骤 4：检测登录日志中的令牌重放

查询 Entra 登录日志以发现令牌窃取的指标：

// KQL query for Microsoft Sentinel or Log Analytics
// Detect sign-ins where the token was issued in one location and used in another
SigninLogs
| where TimeGenerated > ago(7d)
| where RiskDetail contains "token" or RiskEventTypes_V2 has "anomalousToken"
| project TimeGenerated, UserPrincipalName, IPAddress, Location,
          RiskDetail, RiskLevelDuringSignIn, AppDisplayName,
          DeviceDetail, ClientAppUsed, TokenIssuerType
| sort by TimeGenerated desc

// Detect impossible travel with token reuse
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0  // Successful sign-ins only
| summarize Locations=make_set(Location), IPs=make_set(IPAddress),
            Count=count() by UserPrincipalName, bin(TimeGenerated, 1h)
| where array_length(Locations) > 1
| sort by TimeGenerated desc

// Detect device code flow abuse (often used in phishing)
SigninLogs
| where TimeGenerated > ago(7d)
| where AuthenticationProtocol == "deviceCode"
| project TimeGenerated, UserPrincipalName, IPAddress, Location,
          AppDisplayName, DeviceDetail, ResultType
| sort by TimeGenerated desc

// Detect token replay: same token used from multiple IPs
AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| summarize IPs=make_set(IPAddress), IPCount=dcount(IPAddress)
            by UserPrincipalName, CorrelationId
| where IPCount > 1
| sort by IPCount desc

步骤 5：调查并响应令牌窃取

检测到令牌窃取事件时，请遵循以下响应流程：

# Step 5a: Revoke all refresh tokens for the compromised user
# Microsoft Graph PowerShell
Connect-MgGraph -Scopes "User.ReadWrite.All"
Revoke-MgUserSignInSession -UserId "[email protected]"

# Step 5b: Force password reset
Update-MgUser -UserId "[email protected]" -PasswordProfile @{
    ForceChangePasswordNextSignIn = $true
}

# Step 5c: Review and revoke OAuth app consent grants
# Check for malicious app consent (common post-compromise persistence)
Get-MgUserOauth2PermissionGrant -UserId "[email protected]" |
    Select-Object ClientId, ConsentType, Scope

# Remove suspicious OAuth grants
Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId "<grant-id>"

# Step 5d: Review enterprise app registrations for rogue apps
Get-MgServicePrincipal -Filter "displayName eq 'Suspicious App'" |
    Select-Object AppId, DisplayName, SignInAudience

# Step 5e: Check for mail forwarding rules (common post-compromise action)
Get-MgUserMailFolderRule -UserId "[email protected]" -MailFolderId "Inbox" |
    Where-Object { $_.Actions.ForwardTo -ne $null -or $_.Actions.RedirectTo -ne $null }

步骤 6：实施连续访问评估 (CAE)

启用 CAE 以在条件变化时近乎实时地撤销令牌：

Entra Admin Center > Protection > Conditional Access > Continuous Access Evaluation

Settings:
  Strictly enforce location policies: Enabled

CAE ensures that when you revoke a user's session or change their
risk level, the enforcement happens within minutes rather than waiting
for the access token to naturally expire (60-90 minutes).

Critical events that trigger immediate token revocation with CAE:
- User account disabled or deleted
- Password changed or reset
- MFA enabled for the user
- Admin explicitly revokes refresh tokens
- Azure AD Identity Protection detects elevated user risk
- Network location change violates conditional access policy

步骤 7：配置 Defender for Cloud Apps 会话策略

设置实时会话监控以检测和阻止可疑令牌使用：

Microsoft Defender for Cloud Apps > Policies > Session Policies

Policy: "Block download from unmanaged device with stolen token"
  Session Control Type: Monitor and block activities
  Activity Source: App = Office 365, SharePoint Online
  Activity Filter: Device tag does not equal "Compliant"
  Activity Type: Download
  Action: Block

Policy: "Alert on mass file download (exfiltration via stolen token)"
  Session Control Type: Monitor only
  Activity Source: App = Office 365
  Activity Filter: Repeated activity > 10 downloads in 5 minutes
  Action: Alert administrators

关键概念

术语	定义
主刷新令牌 (PRT)	颁发给已注册设备的长期令牌，为所有 Azure AD 集成应用程序提供 SSO，并通过加密方式绑定到设备的 TPM
令牌保护	Entra ID 条件访问功能，将登录会话令牌绑定到设备，防止从其他设备重放
持续访问评估 (CAE)	通过允许资源提供程序订阅 Entra ID 关键事件，实现近实时执行安全策略的协议
AitM（中间人攻击）	一种钓鱼技术，攻击者代理合法的身份验证流程，在受害者完成 MFA 后捕获会话 Cookie
设备代码流	适用于输入受限设备的 OAuth 2.0 授权许可；被攻击者滥用，通过钓鱼向受害者发送设备代码
持有证明 (PoP)	一种加密机制，令牌包含与设备密钥绑定的声明，确保令牌只能由获取它的设备使用
刷新令牌	长期 OAuth 令牌（最长 90 天），用于在不重新进行身份验证的情况下获取新的访问令牌；是持久访问的主要目标

验证

• 已启用 Identity Protection 风险检测，并针对异常令牌活动生成警报
• 条件访问策略阻止高风险登录，并要求中风险登录进行 MFA
• 令牌保护策略已应用于试点组并确认有效（从未注册设备进行测试会失败）
• 针对合成令牌异常事件进行测试时，Sentinel 中的 KQL 查询会返回结果
• 已启用并验证持续访问评估（撤销会话，确认访问在几分钟内被阻止）
• Defender for Cloud Apps 会话策略已激活并监控下载活动
• 通过条件访问限制设备代码流（阻止或要求合规设备）
• 事件响应操作手册包含令牌撤销、密码重置和 OAuth 同意审查步骤
• 针对已泄露账户审计邮件转发规则和 OAuth 应用授权