Attack Chain

1. The attacker crafts a phishing email containing a malicious link that leads to a fake Microsoft login page.
2. The victim clicks the link and is prompted to enter their credentials, unknowingly providing them to the attacker.
3. The attacker uses the stolen credentials to initiate an OAuth authorization flow via the Microsoft Authentication Broker (MAB) with the Device Registration Service (DRS) as the target.
4. The legitimate Microsoft login page redirects the user and returns an authorization code to the attacker-controlled application.
5. The attacker exchanges the authorization code for access and refresh tokens, gaining unauthorized access to the user's Entra ID resources.
6. The attacker uses the access token to enumerate devices registered to the user via Microsoft Graph.
7. The attacker uses the refresh token to maintain persistent access to the user's resources, even after the initial session expires.
8. The attacker leverages access to DRS to potentially manipulate device registrations and further compromise the environment.

Impact

Successful OAuth phishing can lead to unauthorized access to sensitive data and resources within the targeted organization. An attacker with valid access and refresh tokens can impersonate the user, potentially leading to data exfiltration, privilege escalation, and lateral movement within the network. Organizations utilizing Microsoft Entra ID are susceptible, with observed campaigns targeting Microsoft 365 OAuth workflows as reported by Volexity in April 2025.

Recommendation

• Enable and configure the Microsoft Entra ID Sign-In Logs integration to collect sign-in logs, as the detection rule relies on this data source (rule configuration).
• Deploy the provided Sigma rule to your SIEM to detect suspicious OAuth flows involving MAB and DRS based on multiple IP addresses (rule: "Entra ID OAuth Flow from Multiple IPs").
• Review Conditional Access policies for the Microsoft Authentication Broker (app ID: 29d9ed98-a469-4536-ade2-f981bc1d605e) to enforce MFA and device trust (reference: note section in rule definition).
• Monitor network connections for anomalous traffic originating from IPs associated with suspicious OAuth flows (rule: "Entra ID OAuth Flow from Multiple IPs - Network Connection").
• Block access to known phishing domains and URLs used in OAuth phishing campaigns to prevent initial access (IOC: https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/).