Attack Chain

1. The attacker sends a phishing email to a target user, enticing them to click a malicious link.
2. The user is redirected to a fake OAuth consent page, controlled by the attacker, prompting them to grant permissions to a malicious application.
3. The user unknowingly provides consent, granting the attacker access to their Entra ID resources.
4. The attacker exchanges the authorization code for an access or refresh token.
5. The attacker uses the stolen access token to make API calls to Microsoft Graph from a different IP address than the original sign-in.
6. The attacker accesses sensitive data, such as emails, files, or contacts, via the Microsoft Graph API.
7. The attacker may use ROADtools to enumerate permissions and access further resources.
8. The attacker maintains persistence by using the refresh token to obtain new access tokens, even after the initial session expires.

Impact

Successful exploitation can lead to unauthorized access to sensitive data within Microsoft 365, including emails, files, contacts, and other resources accessible via the Microsoft Graph API. Attackers can use this access to perform data exfiltration, business email compromise (BEC), or further lateral movement within the organization. While the rule is designed to minimize false positives, legitimate scenarios like device switching and network roaming may trigger alerts, requiring careful investigation. If malicious activity is confirmed, affected user accounts must be immediately investigated and remediated to prevent further damage.

Recommendation

• Enable and configure the Microsoft Entra ID Sign-In Logs and Microsoft Graph Activity Logs integration to collect audit and activity logs via Azure Event Hub, as outlined in the rule setup instructions.
• Deploy the provided Sigma rule Entra ID OAuth User Impersonation to Microsoft Graph to your SIEM and tune it for your environment, paying close attention to false positives related to device switching and network roaming.
• Review and enforce conditional access policies, including multi-factor authentication and location-based access controls, to mitigate OAuth phishing attacks as mentioned in the triage section.
• Revoke all refresh/access tokens for any user accounts flagged by this rule and reset their credentials, if malicious activity is confirmed.
• Monitor network connections for the IPs detected by the Sigma rule and block them on the perimeter.
• Review session control policies and conditional access enforcement as described in the investigation steps to prevent future token replay attacks.