Azure Entra ID Riskdetection: Anomalous Token Risk Events

title: "Azure Entra ID Riskdetection: Anomalous Token Risk Events"
id: 069d89e5-8379-49fa-8daf-b4f07ea39923
status: test
description: This rule flags Azure Entra ID risk events where the risk event type is anomalousToken, indicating abnormal token characteristics such as unusual token lifetime or use from an unfamiliar location. Attackers may rely on token behaviors that deviate from typical user activity to bypass controls or establish access. The detection relies on risk telemetry from Azure Entra ID Riskdetection that records the anomalousToken riskEventType.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-token
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_token.yml
author: Mark Morowczynski '@markmorow', Huntrule Team
date: 2023-08-07
tags:
  - attack.t1528
  - attack.credential-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: anomalousToken
  condition: selection
falsepositives:
  - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
  - id: 6555754e-5e7f-4a67-ad1c-4041c413a007
    type: derived