MoshsrV 🤘 🇵🇹

The customer contacted us because "Microsoft 365 Defender has detected a security threat", more precisely, the alert "Anomalous Token involving one user" was raised. We tasked the customer to give us access to their Azure Tenant so that we could investigate the logins and conduct a deeper investigation. The first thing I always do in such investigations is check the Risky Sign-ins (you know, low-hanging fruits). The red squares depicted in the screenshot below are logins from the same user, the exact same user who is involved in the anomalous token alert. See, the Microsoft 365 Defender alert we mentioned above was generated on 21/12/2023.. but there are still two other, earlier risky sign-ins. These sign-ins haven't raised any suspicion or alerts. Look at the locations - this looks bad, right? Microsoft writes about these "Anomalous token" detections: "We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. If the location, application, IP address, User Agent, or other characteristics are unexpected for the user, the tenant admin should consider this risk as an indicator of potential token replay." [1] Yes, the user was 100% compromised. It turned out that the first malicious login (mid-November 😱) was from Russia, using a Linux User-Agent (no, the user never used Linux). Plus, during the analysis of the Unified Audit Log of the compromised account, we saw that the attackers used a MacOS User-Agent, whereas the compromised user only used Windows. By the way, the customer was not even aware that such a thing as risky sign-ins exists. And if your organization does not use Linux and or Mac devices, logins from such devices (or with such User-Agents) should be investigated (yes, employees might use their private devices to access company resources), but then correlate the login with country and ASN information. Good luck ☘️ [1] learn.microsoft.com/en-us/az…