Possible ConsentFix - OAuth Token Theft Detected

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	AzureAD
Detection Modules	Identity Threat Module, SaaS Threat Detection
ATT&CK Tactic	Initial Access (TA0001), Credential Access (TA0006), Execution (TA0002)
ATT&CK Technique	Phishing (T1566), User Execution: Malicious Link (T1204.001), Steal Application Access Token (T1528)
Severity	Informational

Description

Detection of potential OAuth token theft via a forced 'localhost' redirect and first-party app abuse. This indicates an attacker has likely bypassed MFA to hijack a user's cloud session.

Attacker's Goals

Bypass identity trust controls to gain persistent unauthorized access to cloud resources.

Investigative actions

• Check for successful logins to Azure CLI or PowerShell from anomalous IPs.
• Review sign-in logs for User-Agents associated with CLI tools or scripts.
• Revoke all active OAuth refresh tokens for the user immediately.

Variations

OAuth Token Theft - Potential Session Hijacking Detected from new ASN

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001), Credential Access (TA0006), Execution (TA0002)
ATT&CK Technique	Phishing (T1566), User Execution: Malicious Link (T1204.001), Steal Application Access Token (T1528)
Severity	Low

Description

Detection of potential OAuth token theft via a forced 'localhost' redirect and first-party app abuse. This indicates an attacker has likely bypassed MFA to hijack a user's cloud session.

Attacker's Goals

Bypass identity trust controls to gain persistent unauthorized access to cloud resources.

Investigative actions

• Check for successful logins to Azure CLI or PowerShell from anomalous IPs.
• Review sign-in logs for User-Agents associated with CLI tools or scripts.
• Revoke all active OAuth refresh tokens for the user immediately.