{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Token replay is a critical risk that bypasses standard MFA and secures persistent directory access through rogue device registration; verifying the absence of these registrations is an essential identity audit." }, "name": "Entra ID Identity Hijack and Persistence", "type": "investigation", "labels": [ "hunt", "attack.t1566", "attack.t1110.003", "attack.t1098", "credential access", "defense evasion", "impact", "initial access", "persistence" ], "series": { "slug": "m365-token-spray-and-replay-campaign-compromises-business-email-accounts", "index": 1, "title": "M365 Token Spray and Replay Campaign Compromises Business Email Accounts", "total": 2 }, "related": [ { "hunt": "m365-inbox-rule-fraud", "reason": "This hunt establishes the identity compromise; a subsequent hunt focuses on the mailbox rules created to hide fraudulent correspondence.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "While standard rules may alert on known malicious IPs, this hunt correlates capture, replay, and persistence across three surfaces and two analysis phases to confirm a successful breach that siloed rules often treat as disconnected noise.", "coverage": [ { "stage": "aitm-phishing-capture", "steps": [ "scoping-signin-infrastructure", "relay-mfa-success" ], "status": "covered" }, { "stage": "token-replay-access", "steps": [ "scoping-signin-infrastructure", "scripted-user-agents" ], "status": "covered" }, { "stage": "rogue-device-registration", "steps": [ "rogue-device-registration-prevalence" ], "status": "covered" }, { "stage": "mfa-method-tampering", "steps": [ "mfa-tampering-audit" ], "status": "covered" }, { "stage": "inbox-rule-evasion", "reason": "Belongs to another part of the 'M365 Token Spray and Replay Campaign Compromises Business Email Accounts' series.", "status": "out_of_scope" }, { "stage": "fraudulent-email-correspondence", "reason": "Belongs to another part of the 'M365 Token Spray and Replay Campaign Compromises Business Email Accounts' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "AiTM Token Capture", "slug": "aitm-phishing-capture", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "185.238.2.195", "2400:8d60:2::1:841d:5dd", "Relay-hosted fake Microsoft sign-in pages", "Device-code phishing flow" ] }, { "name": "Token Replay Authentication", "slug": "token-replay-access", "tactic": "credential-access", "techniques": [ "T1110.003" ], "observables": [ "193.26.115.0/24", "193.26.115.221", "193.26.115.72", "193.26.115.16", "193.26.115.21", "193.26.115.199", "193.26.115.210", "User agent: node", "User agent: Mozilla/5.0", "Request type: OAuth2:Token", "Request type: Login:reprocess", "Client: Microsoft Authentication Broker", "Client: OfficeHome" ] }, { "name": "Rogue Entra Device Registration", "slug": "rogue-device-registration", "tactic": "persistence", "techniques": [ "T1098" ], "observables": [ "Device name: DESKTOP-[0-9A-F]{8}", "Target: Device Registration Service" ] }, { "name": "MFA Tampering and Persistence", "slug": "mfa-method-tampering", "tactic": "persistence", "techniques": [ "T1098" ], "observables": [ "Authenticator label: iPhone 13", "Wiped existing MFA methods", "New authenticator registration within 3 hours of compromise", "Service: Microsoft security-info registration" ] }, { "name": "Stealth Inbox Rule Evasion", "slug": "inbox-rule-evasion", "tactic": "defense-evasion", "techniques": [ "T1564.008" ], "observables": [ "Rule names: sss, s, d", "Rule keywords: payroll, direct deposit, bank, bonus", "Target folders: RSS Feeds, Conversation History", "VPN IPs: 167.148.41.96" ] }, { "name": "Payroll Fraud Correspondence", "slug": "fraudulent-email-correspondence", "tactic": "impact", "techniques": [ "T1566" ], "observables": [ "Outbound payroll emails to external CPAs", "Bulk outbound spam from compromised accounts" ] } ], "summary": "Attackers used adversary-in-the-middle (AiTM) relays to capture Microsoft 365 session tokens, which were then replayed from a centralized hosting provider (1337 Services GmbH) in a large-scale token-spraying campaign. Once authenticated, the actors registered rogue Entra ID devices and modified MFA methods to ensure persistent access before deploying hidden inbox rules to facilitate business email compromise and payroll fraud." }, "severity": "high", "rationale": "Prioritize accounts with Global Administrator roles or finance department associations, as the report highlights these as primary targets for rogue device registration and payroll fraud.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has replayed session tokens stolen through AiTM relays to register rogue devices and establish persistent MFA methods in the victim tenant.", "parameters": { "relay_ips": { "from": { "ref": "huntress-token-replay-spray", "kind": "article", "observed": "2026-10-22" }, "type": "list[ip]", "default": [ "185.238.2.195", "167.148.41.96" ], "description": "Known AiTM relay IP addresses used for capture." }, "replay_ips": { "from": { "ref": "huntress-token-replay-spray", "kind": "article", "observed": "2026-10-22" }, "type": "list[ip]", "default": [ "193.26.115.221", "193.26.115.72", "193.26.115.16", "193.26.115.21", "193.26.115.199", "193.26.115.210" ], "description": "Observed replay IPs from the 1337 Services GmbH block." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to narrow the search." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/token-replay-spray", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/token-replay-spray", "name": "Huntress \u2014 M365 Token Spray and Replay Campaign Compromises Business Email Accounts" } ], "blind_spots": [ { "id": "m365-audit-granularity", "risk": "Without advanced auditing, granular MFA tampering events such as specific factor labels (e.g., iPhone 13) may be missing, leaving only generic success records.", "stage": "mfa-method-tampering", "question": "whether the specific MFA registration event can be attributed to the relay IP", "requires": "M365 Unified Audit Log (UAL) with Advanced Auditing enabled" }, { "id": "token-replay-invisibility", "risk": "Replayed tokens inherit the MFA status of the original session; if telemetry cannot distinguish the relay IP from the replay IP within the same session context, the replay may appear as a legitimate resumption.", "stage": "token-replay-access", "question": "whether existing CA policies were applied to the replayed session", "requires": "hb_auth_signin with conditional_access_status" } ] }, "name": "Entra ID Identity Hijack and Persistence", "description": "This hunt tracks a campaign pairing AiTM phishing with token replay to bypass MFA and secure directory persistence. It follows a phased flow: the first phase identifies potentially hijacked sessions by examining successful MFA attempts from known relay infrastructure and replayed activity using scripted user agents. The second phase correlates these sessions with directory persistence indicators, specifically rogue Entra-joined devices and unauthorized MFA method tampering. This approach ensures that directory-level changes are evaluated in the context of high-probability session compromises." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "m365-token-spray-and-replay-campaign-compromises-business-email-accounts", "index": 1, "title": "M365 Token Spray and Replay Campaign Compromises Business Email Accounts", "total": 2 }, "coverage": [ { "stage": "aitm-phishing-capture", "steps": [ "scoping-signin-infrastructure", "relay-mfa-success" ], "status": "covered" }, { "stage": "token-replay-access", "steps": [ "scoping-signin-infrastructure", "scripted-user-agents" ], "status": "covered" }, { "stage": "rogue-device-registration", "steps": [ "rogue-device-registration-prevalence" ], "status": "covered" }, { "stage": "mfa-method-tampering", "steps": [ "mfa-tampering-audit" ], "status": "covered" }, { "stage": "inbox-rule-evasion", "reason": "Belongs to another part of the 'M365 Token Spray and Replay Campaign Compromises Business Email Accounts' series.", "status": "out_of_scope" }, { "stage": "fraudulent-email-correspondence", "reason": "Belongs to another part of the 'M365 Token Spray and Replay Campaign Compromises Business Email Accounts' series.", "status": "out_of_scope" } ], "rationale": "An adversary has replayed session tokens stolen through AiTM relays to register rogue devices and establish persistent MFA methods in the victim tenant.", "blind_spots": [ { "id": "m365-audit-granularity", "risk": "Without advanced auditing, granular MFA tampering events such as specific factor labels (e.g., iPhone 13) may be missing, leaving only generic success records.", "stage": "mfa-method-tampering", "question": "whether the specific MFA registration event can be attributed to the relay IP", "requires": "M365 Unified Audit Log (UAL) with Advanced Auditing enabled" }, { "id": "token-replay-invisibility", "risk": "Replayed tokens inherit the MFA status of the original session; if telemetry cannot distinguish the relay IP from the replay IP within the same session context, the replay may appear as a legitimate resumption.", "stage": "token-replay-access", "question": "whether existing CA policies were applied to the replayed session", "requires": "hb_auth_signin with conditional_access_status" } ], "scoping_notes": "Prioritize accounts with Global Administrator roles or finance department associations, as the report highlights these as primary targets for rogue device registration and payroll fraud.", "beyond_detection": "While standard rules may alert on known malicious IPs, this hunt correlates capture, replay, and persistence across three surfaces and two analysis phases to confirm a successful breach that siloed rules often treat as disconnected noise." } }, { "id": "scoping-signin-infrastructure", "type": "query", "label": "Scope sessions from known infrastructure", "config": { "dsl": "sqlite", "role": "scoping", "source": "identity", "content": "SELECT DISTINCT device_hostname, actor_user_name FROM hb_auth_signin WHERE (instr(',' || '{{replay_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR instr(',' || '{{relay_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Identify users and endpoints that successfully authenticated from the reported relay or replay IP ranges.", "expected_signal": "A list of potentially compromised users and machines. Silence proofs that the specific infrastructure was not seen in successful logons." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope sessions from known infrastructure", "reads": [ "actor_user_name", "device_hostname", "src_endpoint_ip", "status_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT DISTINCT device_hostname, actor_user_name FROM hb_auth_signin WHERE (instr(',' || '{{replay_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 OR instr(',' || '{{relay_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of potentially compromised users and machines. Silence proofs that the specific infrastructure was not seen in successful logons.", "verified": "dry-run", "verified_at": "2026-10-23" } }, { "id": "scripted-user-agents", "type": "query", "label": "Detect scripted user agents", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "identity", "content": "SELECT device_hostname, actor_user_name, user_agent, src_endpoint_ip, dst_endpoint_name, time FROM hb_auth_signin WHERE (LOWER(user_agent) LIKE '%node%' OR user_agent = 'Mozilla/5.0') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Find logons using 'node' or bare 'Mozilla/5.0' user agents associated with automated token replay tools.", "expected_signal": "Successful logons with scripted agents. Silence means no automated replay was detected via UA strings." }, "parents": [ { "id": "scoping-signin-infrastructure" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Detect scripted user agents", "reads": [ "actor_user_name", "device_hostname", "dst_endpoint_name", "src_endpoint_ip", "status_id", "time", "user_agent" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT device_hostname, actor_user_name, user_agent, src_endpoint_ip, dst_endpoint_name, time FROM hb_auth_signin WHERE (LOWER(user_agent) LIKE '%node%' OR user_agent = 'Mozilla/5.0') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Successful logons with scripted agents. Silence means no automated replay was detected via UA strings.", "verified": "dry-run", "verified_at": "2026-10-23" } }, { "id": "relay-mfa-success", "type": "query", "label": "MFA success from known AiTM relays", "config": { "dsl": "sqlite", "role": "triage", "source": "identity", "content": "SELECT device_hostname, actor_user_name, src_endpoint_ip, auth_requirement, time FROM hb_auth_signin WHERE instr(',' || '{{relay_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND auth_requirement = 'multiFactorAuthentication' AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Identify successful MFA events originating from known relay infrastructure, signifying a likely session capture.", "expected_signal": "User sign-ins using MFA from malicious proxies. Silence indicates no capture activity from these IPs." }, "parents": [ { "id": "scoping-signin-infrastructure" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "MFA success from known AiTM relays", "reads": [ "actor_user_name", "auth_requirement", "device_hostname", "src_endpoint_ip", "status_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT device_hostname, actor_user_name, src_endpoint_ip, auth_requirement, time FROM hb_auth_signin WHERE instr(',' || '{{relay_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0 AND auth_requirement = 'multiFactorAuthentication' AND status_id = 1 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "User sign-ins using MFA from malicious proxies. Silence indicates no capture activity from these IPs.", "verified": "dry-run", "verified_at": "2026-10-23" } }, { "id": "early-stage-triage", "type": "analytic", "label": "Assess session hijack probability", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "scoping-signin-infrastructure", "scripted-user-agents", "relay-mfa-success" ], "objective": "Identify users with MFA success from relay infrastructure followed by automated activity from replay infrastructure.", "description": "Identify users showing a pattern of session capture followed by replayed or automated activity.", "max_iterations": 3, "expected_signal": "A per-user verdict on hijack probability.", "success_criteria": "A verdict citing correlation in timing and IP between capture and replay." }, "parents": [ { "id": "scripted-user-agents", "kind": "merge" }, { "id": "relay-mfa-success", "kind": "merge" } ] }, { "id": "rogue-device-registration-prevalence", "type": "query", "label": "Rare rogue device registration", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT hostname, provider, COUNT(DISTINCT device_uid) AS device_count, MIN(time) AS first_seen FROM hb_devices WHERE provider = 'azure_ad' AND LOWER(hostname) LIKE 'desktop-%' AND length(hostname) = 16 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY hostname, provider HAVING device_count <= 2", "surface": "hb_devices", "description": "Stack-count devices matching the campaign naming convention to identify rare rogue registrations across the fleet.", "expected_signal": "Rare devices matching the DESKTOP-[HEX8] pattern. Silence means no such registrations were detected." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare rogue device registration", "reads": [ "device_uid", "first_seen", "hostname", "provider", "time" ], "source": "hb_devices", "target": "endpoint", "content": "SELECT hostname, provider, COUNT(DISTINCT device_uid) AS device_count, MIN(time) AS first_seen FROM hb_devices WHERE provider = 'azure_ad' AND LOWER(hostname) LIKE 'desktop-%' AND length(hostname) = 16 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY hostname, provider HAVING device_count <= 2", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare devices matching the DESKTOP-[HEX8] pattern. Silence means no such registrations were detected.", "verified": "dry-run", "prevalence": { "by": "device_uid", "key": [ "hostname" ], "rare_below": 3 }, "verified_at": "2026-10-23" } }, { "id": "mfa-tampering-audit", "type": "query", "label": "MFA method modifications", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT actor_user_name, api_operation, resource_name, api_service_name, status, time FROM hb_cloud_api_activity WHERE provider = 'azure_ad' AND (LOWER(api_operation) LIKE '%strongauthentication%' OR LOWER(api_operation) LIKE '%mfa%') AND (LOWER(api_operation) LIKE '%delete%' OR LOWER(api_operation) LIKE '%update%' OR LOWER(api_operation) LIKE '%add%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_cloud_api_activity", "description": "Identify API activity related to modifying MFA methods for users identified in the first phase.", "expected_signal": "Cloud API calls targeting MFA settings. Silence proofs no such audit events occurred in the window." }, "parents": [ { "id": "early-stage-triage" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "MFA method modifications", "reads": [ "actor_user_name", "api_operation", "api_service_name", "provider", "resource_name", "status", "time" ], "source": "hb_cloud_api_activity", "target": "endpoint", "content": "SELECT actor_user_name, api_operation, resource_name, api_service_name, status, time FROM hb_cloud_api_activity WHERE provider = 'azure_ad' AND (LOWER(api_operation) LIKE '%strongauthentication%' OR LOWER(api_operation) LIKE '%mfa%') AND (LOWER(api_operation) LIKE '%delete%' OR LOWER(api_operation) LIKE '%update%' OR LOWER(api_operation) LIKE '%add%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Cloud API calls targeting MFA settings. Silence proofs no such audit events occurred in the window.", "verified": "dry-run", "verified_at": "2026-10-23" } }, { "id": "persistence-synthesis", "type": "analytic", "label": "Synthesize hijack and persistence", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "early-stage-triage", "rogue-device-registration-prevalence", "mfa-tampering-audit" ], "objective": "Determine if hijacked users identified in the first triage show corresponding persistence activity such as rogue device registration or MFA tampering.", "description": "Determine if hijacked users show corresponding directory-level persistence like rogue devices or MFA changes.", "max_iterations": 5, "expected_signal": "A comprehensive verdict per user and device.", "success_criteria": "A final verdict citing the entire chain from capture to directory changes." }, "parents": [ { "id": "rogue-device-registration-prevalence", "kind": "merge" }, { "id": "mfa-tampering-audit", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on compromise", "config": { "fuzzy": true, "judge": "hunter", "question": "the persistence-synthesis verdict is malicious for at least one user or device", "condition": "the persistence-synthesis verdict is malicious for at least one user or device", "blind_spot": "m365-audit-granularity", "confidence": "high", "description": "Route the hunt results to containment or manual review based on the synthesized verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "persistence-synthesis" } ] }, { "id": "isolate-and-revoke", "type": "action", "label": "Isolate compromised accounts", "config": { "target": "identity", "description": "Immediately contain the threat by revoking compromised sessions and refresh tokens.", "instructions": "Revoke all active sessions and refresh tokens for the compromised accounts. Temporarily disable account access pending a full MFA reset and password rotation.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "cleanup-persistence", "type": "action", "label": "Clean-up persistence mechanisms", "config": { "target": "identity", "description": "Remove the specific directory-level persistence objects identified by the hunt.", "instructions": "Delete rogue devices matching the DESKTOP-[HEX8] naming convention from the tenant directory. Audit the registered MFA methods for the affected users in the Entra portal and remove any factors not explicitly confirmed by the user.", "action_approval": "required" }, "parents": [ { "id": "isolate-and-revoke" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst final review", "config": { "assignee": "analyst", "description": "Review findings and confirm cleanup completion.", "instructions": "Review the synthesized verdict and confirm that all identified persistence mechanisms have been removed. Record tuning notes for any false positives found during the triage phase." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "cleanup-persistence" } ] }, { "id": "close-out", "type": "task", "label": "Hunt close out", "config": { "assignee": "analyst", "description": "Document findings and evaluate defensive hardening to prevent recurrence.", "instructions": "Record the affected users and any newly identified malicious IP infrastructure. Evaluate Conditional Access policies to enforce compliant-device requirements for high-value resources to mitigate future token replay." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }