[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7EM0BC9DFTKK4XTWYJHC4WT":3,"skill-same:01M7EM0BC9DFTKK4XTWYJHC4WT":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":6,"ownerHtmlUrl":46,"ownerBlogUrl":6,"ownerDescription":47,"updatedAt":48,"install":49,"resources":62},"01M7EM0BC9DFTKK4XTWYJHC4WT","hunting-saas-sso-token-abuse",null,"Hunts for stolen-session and OAuth\u002FPRT token replay (T1550.001) by correlating Microsoft Entra ID SigninLogs SessionId\u002FUniqueTokenIdentifier fields and Okta System Log sso\u002Fsession events to spot impossible travel, refresh-token reuse, and token use from anomalous ASNs. Use when hunting MFA-bypass via stolen cookies\u002Ftokens, investigating impossible-travel alerts, or scoping SaaS lateral movement after phishing.","lza6\u002FArmor-piercing-system-prompts","lza6","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F128880206?v=4","01M7EB3K7WPX5T28EJ2NVHE6EG","Chinese-tingfeng","01M7EB3K97E1KQ16QWKJMFNGX8",11,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fhunting-saas-sso-token-abuse\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: hunting-saas-sso-token-abuse\ndescription: Hunts for stolen-session and OAuth\u002FPRT token replay (T1550.001) by correlating Microsoft Entra ID SigninLogs SessionId\u002FUniqueTokenIdentifier fields and Okta System Log sso\u002Fsession events to spot impossible travel, refresh-token reuse, and token use from anomalous ASNs. Use when hunting MFA-bypass via stolen cookies\u002Ftokens, investigating impossible-travel alerts, or scoping SaaS lateral movement after phishing.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- threat-hunting\n- sso\n- oauth\n- token-theft\n- pass-the-cookie\n- entra-id\n- okta\n- detection-engineering\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\nmitre_attack:\n- T1550.001\n---\n# Hunting SaaS SSO Token Abuse\n\n## Overview\n\nAdversaries increasingly bypass MFA not by defeating it but by stealing the artifacts issued *after* a successful authentication — session cookies, OAuth access\u002Frefresh tokens, and Primary Refresh Tokens (PRTs). With a stolen token an attacker replays the existing session (\"pass-the-cookie\" \u002F token replay), inheriting the victim's authenticated state across federated SaaS without ever prompting for credentials or MFA. Mandiant's M-Trends reporting and Microsoft\u002FOkta incident data both highlight token theft as a dominant cloud lateral-movement technique, mapped to MITRE ATT&CK **T1550.001 Use Alternate Authentication Material: Application Access Token**.\n\nDetection relies on correlating identity telemetry rather than watching for failed logins. In Microsoft Entra ID the key tables are `SigninLogs` (interactive), `AADNonInteractiveUserSignInLogs` (where replayed cookies\u002Frefresh tokens commonly surface), and `AADServicePrincipalSignInLogs`. Entra now exposes *linkable identifiers* — `SessionId` and `UniqueTokenIdentifier` — that let a hunter stitch every artifact derived from one root authentication event together and spot a single session being used from multiple IPs, ASNs, or device fingerprints. In Okta the System Log carries `authentication.sso`, `policy.evaluate_sign_on`, and `user.session.start` events with a `deviceToken`\u002Fsession context; the same session token appearing from divergent IPs\u002Fuser-agents is the tell. Okta Identity Threat Protection (ITP) can natively flag \"suspected session hijacking.\"\n\nThis skill provides a hypothesis-driven hunt: baseline normal session behavior, then look for impossible travel within a single session, refresh-token reuse, token use from anomalous infrastructure (hosting\u002FVPS ASNs), and SaaS access patterns inconsistent with the user's device. Source: MITRE ATT&CK T1550.001; Microsoft Entra ID sign-in log documentation; Okta System Log reference; Mandiant M-Trends.\n\n## When to Use\n\n- Threat hunting for MFA-bypass via stolen tokens\u002Fcookies across Entra ID and SaaS\n- Investigating an alert for impossible travel, anomalous OAuth grant, or token reuse\n- Validating detection coverage for T1550.001 after a phishing\u002FAiTM incident\n- Building Sentinel\u002FSplunk\u002FOkta detections for session-token replay\n- Post-incident hunting to scope SaaS lateral movement from a compromised identity\n\n## Prerequisites\n\n- Entra ID sign-in logs flowing to a queryable store (Microsoft Sentinel \u002F Log Analytics):\n  ```bash\n  # Confirm the diagnostic settings export SigninLogs + non-interactive logs to a workspace\n  az monitor diagnostic-settings list --resource \\\n    \u002Fproviders\u002FMicrosoft.aadiam\u002FdiagnosticSettings -o table\n  ```\n- Okta System Log access via API or SIEM ingestion:\n  ```bash\n  curl -s -H \"Authorization: SSWS $OKTA_API_TOKEN\" \\\n    \"https:\u002F\u002F\u003Corg>.okta.com\u002Fapi\u002Fv1\u002Flogs?filter=eventType eq \\\"user.session.start\\\"&since=2026-06-01T00:00:00Z\"\n  ```\n- An IP enrichment source (GeoIP + ASN\u002Fhosting-provider classification)\n- Read access to the SIEM (KQL for Sentinel, SPL for Splunk)\n- Python 3.9+ for the helper script (`requests` for the Okta API)\n\n## Objectives\n\n- Baseline normal per-user session behavior (IPs, ASNs, devices, SaaS apps)\n- Correlate Entra sign-in artifacts by `SessionId` \u002F `UniqueTokenIdentifier`\n- Detect a single session used from multiple IPs\u002FASNs (token replay)\n- Detect impossible travel within one authenticated session\n- Detect refresh-token reuse and anomalous OAuth grants\n- Hunt Okta System Log for reused session tokens across contexts\n- Produce findings and feed confirmed patterns into standing detections\n\n## MITRE ATT&CK Mapping\n\n| ID | Name | Use in this skill |\n|----|------|-------------------|\n| T1550.001 | Use Alternate Authentication Material: Application Access Token | Core technique — replaying stolen OAuth tokens\u002Fcookies |\n| T1539 | Steal Web Session Cookie | The cookie theft that precedes pass-the-cookie replay |\n| T1528 | Steal Application Access Token | Acquisition of OAuth tokens via phishing\u002Fillicit consent |\n| T1078.004 | Valid Accounts: Cloud Accounts | Replayed tokens grant valid-account access to SaaS |\n| T1098.001 | Account Manipulation: Additional Cloud Credentials | Follow-on persistence after token abuse |\n\n## Workflow\n\n### 1. Correlate Entra sign-in artifacts by session\nStitch interactive, non-interactive, and SP sign-ins for one session to see the full chain.\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(7d)\n| where isnotempty(SessionId)\n| summarize IPs=make_set(IPAddress), Apps=make_set(AppDisplayName),\n            Locations=make_set(tostring(LocationDetails.countryOrRegion)),\n            Count=count() by SessionId, UserPrincipalName\n| where array_length(IPs) > 1\n```\n\n### 2. Detect a single session used from multiple ASNs (token replay)\n```kusto\nAADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(24h)\n| extend ASN = tostring(parse_json(tostring(NetworkLocationDetails))[0].networkType)\n| summarize distinctIPs = dcount(IPAddress),\n            ipset = make_set(IPAddress) by SessionId, UserPrincipalName\n| where distinctIPs >= 2\n```\n\n### 3. Detect impossible travel within one authenticated session\n```kusto\nSigninLogs\n| where TimeGenerated > ago(7d)\n| project TimeGenerated, UserPrincipalName, IPAddress,\n          City=tostring(LocationDetails.city),\n          Country=tostring(LocationDetails.countryOrRegion), SessionId\n| order by UserPrincipalName, TimeGenerated asc\n| serialize\n| extend prevCountry = prev(Country), prevTime = prev(TimeGenerated),\n         prevUser = prev(UserPrincipalName)\n| where UserPrincipalName == prevUser and Country != prevCountry\n        and datetime_diff('minute', TimeGenerated, prevTime) \u003C 60\n```\n\n### 4. Detect token use from hosting\u002FVPS infrastructure\nReplayed tokens are frequently used from datacenter ASNs, unlike the user's residential\u002Fcorporate ranges.\n```kusto\nAADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(24h)\n| where ResultType == 0\n| extend asnOrg = tostring(parse_json(tostring(AutonomousSystemNumber)))\n| where IPAddress in (toscalar(externaldata(ip:string)[\"\u003Chosting-asn-iplist>\"]))\n| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress\n```\n\n### 5. Hunt anomalous OAuth grants \u002F illicit consent (token theft precursor)\n```kusto\nAuditLogs\n| where TimeGenerated > ago(30d)\n| where OperationName in (\"Consent to application\", \"Add OAuth2PermissionGrant\",\n                          \"Add delegated permission grant\")\n| extend app = tostring(TargetResources[0].displayName)\n| project TimeGenerated, InitiatedBy, app, Result\n```\n\n### 6. Hunt the Okta System Log for reused session tokens\nA single Okta session (`deviceToken`) used from divergent IPs\u002Fclients indicates hijack.\n```bash\ncurl -s -H \"Authorization: SSWS $OKTA_API_TOKEN\" \\\n  \"https:\u002F\u002F\u003Corg>.okta.com\u002Fapi\u002Fv1\u002Flogs?filter=eventType eq \\\"policy.evaluate_sign_on\\\"&since=2026-06-15T00:00:00Z\" \\\n  | jq -r '.[] | [.authenticationContext.externalSessionId, .client.ipAddress, .client.userAgent.rawUserAgent] | @tsv' \\\n  | sort | uniq -c | sort -rn\n```\n\n### 7. Splunk equivalent for Okta session reuse\n```spl\nindex=okta eventType=\"policy.evaluate_sign_on\"\n| stats dc(client.ipAddress) as ip_count\n        values(client.ipAddress) as ips\n        values(client.userAgent.rawUserAgent) as agents\n        by authenticationContext.externalSessionId actor.alternateId\n| where ip_count > 1\n```\n\n### 8. Triage and respond\nFor confirmed token abuse, revoke sessions and rotate, then promote the hunt to a rule.\n```bash\n# Revoke all refresh tokens \u002F sessions for the user in Entra\naz rest --method POST \\\n  --url \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F\u003CuserId>\u002FrevokeSignInSessions\"\n```\nSee `scripts\u002Fagent.py` to pull Okta logs and flag reused session tokens automatically.\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| MITRE ATT&CK T1550.001 | Technique reference | https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1550\u002F001\u002F |\n| Entra sign-in logs schema | KQL hunting field reference | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fmonitoring-health\u002Freference-azure-monitor-sign-ins-log-schema |\n| Azure-Sentinel hunting repo | Community KQL detections | https:\u002F\u002Fgithub.com\u002FAzure\u002FAzure-Sentinel |\n| Okta System Log API | Event hunting source | https:\u002F\u002Fdeveloper.okta.com\u002Fdocs\u002Freference\u002Fapi\u002Fsystem-log\u002F |\n| Mandiant M-Trends | Token-theft threat landscape | https:\u002F\u002Fwww.mandiant.com\u002Fm-trends |\n| AzureAD-Attack-Defense | PRT\u002Ftoken replay detection guidance | https:\u002F\u002Fgithub.com\u002FCloud-Architekt\u002FAzureAD-Attack-Defense |\n\n## Preventive Controls to Recommend\n\nDetection should pair with controls that make stolen tokens far less useful:\n\n- **Entra Conditional Access \"token protection\"** binds the sign-in session to the\n  device, so an exfiltrated cookie\u002FPRT cannot be replayed off-device.\n- **Continuous Access Evaluation (CAE)** revokes access in near-real-time on risk\n  events instead of waiting for token expiry.\n- **Phishing-resistant MFA (FIDO2\u002Fpasskeys)** blocks the AiTM proxy phishing that\n  harvests tokens in the first place.\n- **Short token lifetimes + refresh-token rotation** shrink the replay window and turn\n  refresh-token reuse into an unambiguous compromise signal.\n- **Okta Identity Threat Protection (ITP)** flags suspected session hijacking natively.\n\n## False-Positive Tuning\n\n| Benign cause | Tuning |\n|--------------|--------|\n| Corporate VPN\u002Fproxy egress (many users, few IPs) | Allowlist known egress IPs\u002FASNs |\n| Mobile carrier IP rotation | Widen impossible-travel time\u002Fdistance thresholds |\n| Legitimate multi-device users | Correlate device IDs, not just IPs |\n| Backend\u002FAPI calls within one session | Exclude expected service principals |\n\n## Key Indicators\n\n| Indicator | Signal |\n|-----------|--------|\n| One `SessionId` across multiple IPs\u002FASNs | Token\u002Fcookie replay |\n| Non-interactive sign-in from new datacenter IP | Replayed refresh token |\n| Impossible travel within \u003C 1h | Concurrent session use |\n| Refresh-token reuse after rotation | Strong compromise signal |\n| New OAuth consent to unfamiliar app | Illicit-consent token theft |\n| Okta session token from divergent user-agents | Session hijack |\n\n## Validation Criteria\n\n- [ ] Entra `SigninLogs` and `AADNonInteractiveUserSignInLogs` queryable\n- [ ] Okta System Log accessible via API or SIEM\n- [ ] Per-session correlation by `SessionId` produces results\n- [ ] Multi-IP \u002F multi-ASN single-session query implemented\n- [ ] Impossible-travel-within-session query implemented\n- [ ] Anomalous OAuth consent hunt implemented\n- [ ] Okta reused-session-token hunt implemented\n- [ ] Confirmed findings triaged and sessions revoked\n- [ ] Effective queries promoted to standing detection rules\n- [ ] False-positive baseline (VPN\u002Fproxy egress) documented\n","# Hunting SaaS SSO Token Abuse\n\n## Overview\n\nAdversaries increasingly bypass MFA not by defeating it but by stealing the artifacts issued *after* a successful authentication — session cookies, OAuth access\u002Frefresh tokens, and Primary Refresh Tokens (PRTs). With a stolen token an attacker replays the existing session (\"pass-the-cookie\" \u002F token replay), inheriting the victim's authenticated state across federated SaaS without ever prompting for credentials or MFA. Mandiant's M-Trends reporting and Microsoft\u002FOkta incident data both highlight token theft as a dominant cloud lateral-movement technique, mapped to MITRE ATT&CK **T1550.001 Use Alternate Authentication Material: Application Access Token**.\n\nDetection relies on correlating identity telemetry rather than watching for failed logins. In Microsoft Entra ID the key tables are `SigninLogs` (interactive), `AADNonInteractiveUserSignInLogs` (where replayed cookies\u002Frefresh tokens commonly surface), and `AADServicePrincipalSignInLogs`. Entra now exposes *linkable identifiers* — `SessionId` and `UniqueTokenIdentifier` — that let a hunter stitch every artifact derived from one root authentication event together and spot a single session being used from multiple IPs, ASNs, or device fingerprints. In Okta the System Log carries `authentication.sso`, `policy.evaluate_sign_on`, and `user.session.start` events with a `deviceToken`\u002Fsession context; the same session token appearing from divergent IPs\u002Fuser-agents is the tell. Okta Identity Threat Protection (ITP) can natively flag \"suspected session hijacking.\"\n\nThis skill provides a hypothesis-driven hunt: baseline normal session behavior, then look for impossible travel within a single session, refresh-token reuse, token use from anomalous infrastructure (hosting\u002FVPS ASNs), and SaaS access patterns inconsistent with the user's device. Source: MITRE ATT&CK T1550.001; Microsoft Entra ID sign-in log documentation; Okta System Log reference; Mandiant M-Trends.\n\n## When to Use\n\n- Threat hunting for MFA-bypass via stolen tokens\u002Fcookies across Entra ID and SaaS\n- Investigating an alert for impossible travel, anomalous OAuth grant, or token reuse\n- Validating detection coverage for T1550.001 after a phishing\u002FAiTM incident\n- Building Sentinel\u002FSplunk\u002FOkta detections for session-token replay\n- Post-incident hunting to scope SaaS lateral movement from a compromised identity\n\n## Prerequisites\n\n- Entra ID sign-in logs flowing to a queryable store (Microsoft Sentinel \u002F Log Analytics):\n  ```bash\n  # Confirm the diagnostic settings export SigninLogs + non-interactive logs to a workspace\n  az monitor diagnostic-settings list --resource \\\n    \u002Fproviders\u002FMicrosoft.aadiam\u002FdiagnosticSettings -o table\n  ```\n- Okta System Log access via API or SIEM ingestion:\n  ```bash\n  curl -s -H \"Authorization: SSWS $OKTA_API_TOKEN\" \\\n    \"https:\u002F\u002F\u003Corg>.okta.com\u002Fapi\u002Fv1\u002Flogs?filter=eventType eq \\\"user.session.start\\\"&since=2026-06-01T00:00:00Z\"\n  ```\n- An IP enrichment source (GeoIP + ASN\u002Fhosting-provider classification)\n- Read access to the SIEM (KQL for Sentinel, SPL for Splunk)\n- Python 3.9+ for the helper script (`requests` for the Okta API)\n\n## Objectives\n\n- Baseline normal per-user session behavior (IPs, ASNs, devices, SaaS apps)\n- Correlate Entra sign-in artifacts by `SessionId` \u002F `UniqueTokenIdentifier`\n- Detect a single session used from multiple IPs\u002FASNs (token replay)\n- Detect impossible travel within one authenticated session\n- Detect refresh-token reuse and anomalous OAuth grants\n- Hunt Okta System Log for reused session tokens across contexts\n- Produce findings and feed confirmed patterns into standing detections\n\n## MITRE ATT&CK Mapping\n\n| ID | Name | Use in this skill |\n|----|------|-------------------|\n| T1550.001 | Use Alternate Authentication Material: Application Access Token | Core technique — replaying stolen OAuth tokens\u002Fcookies |\n| T1539 | Steal Web Session Cookie | The cookie theft that precedes pass-the-cookie replay |\n| T1528 | Steal Application Access Token | Acquisition of OAuth tokens via phishing\u002Fillicit consent |\n| T1078.004 | Valid Accounts: Cloud Accounts | Replayed tokens grant valid-account access to SaaS |\n| T1098.001 | Account Manipulation: Additional Cloud Credentials | Follow-on persistence after token abuse |\n\n## Workflow\n\n### 1. Correlate Entra sign-in artifacts by session\nStitch interactive, non-interactive, and SP sign-ins for one session to see the full chain.\n```kusto\nunion SigninLogs, AADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(7d)\n| where isnotempty(SessionId)\n| summarize IPs=make_set(IPAddress), Apps=make_set(AppDisplayName),\n            Locations=make_set(tostring(LocationDetails.countryOrRegion)),\n            Count=count() by SessionId, UserPrincipalName\n| where array_length(IPs) > 1\n```\n\n### 2. Detect a single session used from multiple ASNs (token replay)\n```kusto\nAADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(24h)\n| extend ASN = tostring(parse_json(tostring(NetworkLocationDetails))[0].networkType)\n| summarize distinctIPs = dcount(IPAddress),\n            ipset = make_set(IPAddress) by SessionId, UserPrincipalName\n| where distinctIPs >= 2\n```\n\n### 3. Detect impossible travel within one authenticated session\n```kusto\nSigninLogs\n| where TimeGenerated > ago(7d)\n| project TimeGenerated, UserPrincipalName, IPAddress,\n          City=tostring(LocationDetails.city),\n          Country=tostring(LocationDetails.countryOrRegion), SessionId\n| order by UserPrincipalName, TimeGenerated asc\n| serialize\n| extend prevCountry = prev(Country), prevTime = prev(TimeGenerated),\n         prevUser = prev(UserPrincipalName)\n| where UserPrincipalName == prevUser and Country != prevCountry\n        and datetime_diff('minute', TimeGenerated, prevTime) \u003C 60\n```\n\n### 4. Detect token use from hosting\u002FVPS infrastructure\nReplayed tokens are frequently used from datacenter ASNs, unlike the user's residential\u002Fcorporate ranges.\n```kusto\nAADNonInteractiveUserSignInLogs\n| where TimeGenerated > ago(24h)\n| where ResultType == 0\n| extend asnOrg = tostring(parse_json(tostring(AutonomousSystemNumber)))\n| where IPAddress in (toscalar(externaldata(ip:string)[\"\u003Chosting-asn-iplist>\"]))\n| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress\n```\n\n### 5. Hunt anomalous OAuth grants \u002F illicit consent (token theft precursor)\n```kusto\nAuditLogs\n| where TimeGenerated > ago(30d)\n| where OperationName in (\"Consent to application\", \"Add OAuth2PermissionGrant\",\n                          \"Add delegated permission grant\")\n| extend app = tostring(TargetResources[0].displayName)\n| project TimeGenerated, InitiatedBy, app, Result\n```\n\n### 6. Hunt the Okta System Log for reused session tokens\nA single Okta session (`deviceToken`) used from divergent IPs\u002Fclients indicates hijack.\n```bash\ncurl -s -H \"Authorization: SSWS $OKTA_API_TOKEN\" \\\n  \"https:\u002F\u002F\u003Corg>.okta.com\u002Fapi\u002Fv1\u002Flogs?filter=eventType eq \\\"policy.evaluate_sign_on\\\"&since=2026-06-15T00:00:00Z\" \\\n  | jq -r '.[] | [.authenticationContext.externalSessionId, .client.ipAddress, .client.userAgent.rawUserAgent] | @tsv' \\\n  | sort | uniq -c | sort -rn\n```\n\n### 7. Splunk equivalent for Okta session reuse\n```spl\nindex=okta eventType=\"policy.evaluate_sign_on\"\n| stats dc(client.ipAddress) as ip_count\n        values(client.ipAddress) as ips\n        values(client.userAgent.rawUserAgent) as agents\n        by authenticationContext.externalSessionId actor.alternateId\n| where ip_count > 1\n```\n\n### 8. Triage and respond\nFor confirmed token abuse, revoke sessions and rotate, then promote the hunt to a rule.\n```bash\n# Revoke all refresh tokens \u002F sessions for the user in Entra\naz rest --method POST \\\n  --url \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fusers\u002F\u003CuserId>\u002FrevokeSignInSessions\"\n```\nSee `scripts\u002Fagent.py` to pull Okta logs and flag reused session tokens automatically.\n\n## Tools and Resources\n\n| Resource | Purpose | Link |\n|----------|---------|------|\n| MITRE ATT&CK T1550.001 | Technique reference | https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1550\u002F001\u002F |\n| Entra sign-in logs schema | KQL hunting field reference | https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fmonitoring-health\u002Freference-azure-monitor-sign-ins-log-schema |\n| Azure-Sentinel hunting repo | Community KQL detections | https:\u002F\u002Fgithub.com\u002FAzure\u002FAzure-Sentinel |\n| Okta System Log API | Event hunting source | https:\u002F\u002Fdeveloper.okta.com\u002Fdocs\u002Freference\u002Fapi\u002Fsystem-log\u002F |\n| Mandiant M-Trends | Token-theft threat landscape | https:\u002F\u002Fwww.mandiant.com\u002Fm-trends |\n| AzureAD-Attack-Defense | PRT\u002Ftoken replay detection guidance | https:\u002F\u002Fgithub.com\u002FCloud-Architekt\u002FAzureAD-Attack-Defense |\n\n## Preventive Controls to Recommend\n\nDetection should pair with controls that make stolen tokens far less useful:\n\n- **Entra Conditional Access \"token protection\"** binds the sign-in session to the\n  device, so an exfiltrated cookie\u002FPRT cannot be replayed off-device.\n- **Continuous Access Evaluation (CAE)** revokes access in near-real-time on risk\n  events instead of waiting for token expiry.\n- **Phishing-resistant MFA (FIDO2\u002Fpasskeys)** blocks the AiTM proxy phishing that\n  harvests tokens in the first place.\n- **Short token lifetimes + refresh-token rotation** shrink the replay window and turn\n  refresh-token reuse into an unambiguous compromise signal.\n- **Okta Identity Threat Protection (ITP)** flags suspected session hijacking natively.\n\n## False-Positive Tuning\n\n| Benign cause | Tuning |\n|--------------|--------|\n| Corporate VPN\u002Fproxy egress (many users, few IPs) | Allowlist known egress IPs\u002FASNs |\n| Mobile carrier IP rotation | Widen impossible-travel time\u002Fdistance thresholds |\n| Legitimate multi-device users | Correlate device IDs, not just IPs |\n| Backend\u002FAPI calls within one session | Exclude expected service principals |\n\n## Key Indicators\n\n| Indicator | Signal |\n|-----------|--------|\n| One `SessionId` across multiple IPs\u002FASNs | Token\u002Fcookie replay |\n| Non-interactive sign-in from new datacenter IP | Replayed refresh token |\n| Impossible travel within \u003C 1h | Concurrent session use |\n| Refresh-token reuse after rotation | Strong compromise signal |\n| New OAuth consent to unfamiliar app | Illicit-consent token theft |\n| Okta session token from divergent user-agents | Session hijack |\n\n## Validation Criteria\n\n- [ ] Entra `SigninLogs` and `AADNonInteractiveUserSignInLogs` queryable\n- [ ] Okta System Log accessible via API or SIEM\n- [ ] Per-session correlation by `SessionId` produces results\n- [ ] Multi-IP \u002F multi-ASN single-session query implemented\n- [ ] Impossible-travel-within-session query implemented\n- [ ] Anomalous OAuth consent hunt implemented\n- [ ] Okta reused-session-token hunt implemented\n- [ ] Confirmed findings triaged and sessions revoked\n- [ ] Effective queries promoted to standing detection rules\n- [ ] False-positive baseline (VPN\u002Fproxy egress) documented\n",{"name":5,"tags":24,"author":33,"domain":34,"license":15,"version":35,"nist_csf":36,"subdomain":38,"description":7,"mitre_attack":39},[25,26,27,28,29,30,31,32],"threat-hunting","sso","oauth","token-theft","pass-the-cookie","entra-id","okta","detection-engineering","mahipal","cybersecurity","1.0",[37],"DE.CM-01","soc-operations",[40],"T1550.001","main","d69096e239f2a89aabc2cd078c47664a9d3b1e11","04-安全渗透\u002Fhunting-saas-sso-token-abuse",3,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts","https:\u002F\u002Fgithub.com\u002Flza6","个人vx：Tf00798\r\n个人✈：@TFGY999","2026-10-08 14:29:22",{"source":8,"skillName":5,"commands":50,"prompt":60,"zipAvailable":61},[51,54,57],{"tool":52,"command":53},"npx","npx skills add lza6\u002FArmor-piercing-system-prompts --skill hunting-saas-sso-token-abuse",{"tool":55,"command":56},"bunx","bunx skills add lza6\u002FArmor-piercing-system-prompts --skill hunting-saas-sso-token-abuse",{"tool":58,"command":59},"pnpm","pnpm dlx skills add lza6\u002FArmor-piercing-system-prompts --skill hunting-saas-sso-token-abuse","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fhunting-saas-sso-token-abuse\u002FSKILL.md",true,[63,69],{"path":64,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":68},"references\u002Fapi-reference.md","REFERENCE","参考文档",2231,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fhunting-saas-sso-token-abuse\u002Freferences\u002Fapi-reference.md",{"path":70,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":71,"sourceHtmlUrl":72},"references\u002Fstandards.md",1423,"https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F04-安全渗透\u002Fhunting-saas-sso-token-abuse\u002Freferences\u002Fstandards.md",[74,82,89,96,103,110],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":19},"01M7EXRM12046G0GM1WGMMFXCN","ci-cd-and-automation","Automates CI\u002FCD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.","MIT","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fci-cd-and-automation\u002FSKILL.md",[],[],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":19},"01M7EXRFYYSJ3Y15AGPDDEWWQD","chrome-devtools","Uses Chrome DevTools via MCP for efficient debugging, troubleshooting and browser automation. Use when debugging web pages, automating browser interactions, analyzing performance, or inspecting network requests. This skill does not apply to `--slim` mode (MCP configuration).","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchrome-devtools\u002FSKILL.md",[],[],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":19},"01M7EXR6EYPE4X5X1BTAE6QJRV","chrome-cdp","Drive a real Chrome via the Chrome DevTools Protocol (CDP). Ensures a\ndebuggable Chrome is running (launching it if needed) so the agent can\nnavigate, read page content, inspect the DOM, run JavaScript, and take\nscreenshots — without the user typing any launch command. Includes a\nfirst-class \"review a live running app\" flow: point Chrome at the app under\ndevelopment and inspect\u002Fscreenshot the REAL page (what a static-artifact tool\ncannot do). Backed by Glimpse and the chrome-devtools MCP server. Use when\nasked to \"use chrome\", \"open chrome\", \"drive my browser\", \"read the page in\nchrome\", \"review the running app\", \"screenshot the app\", or \"\u002Fchrome-cdp\".","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchrome-cdp\u002FSKILL.md",[],[],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":19},"01M7EXR1Y7E79KQKG4J798XGH6","check-identity-pack","Run an AFP 100-point or AUSTRAC safe-harbour identity check over a set of documents, and report exactly what's missing. Use when the user asks to check identity documents, verify someone's ID for onboarding, or assess whether a document pack satisfies Australian identity requirements.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fcheck-identity-pack\u002FSKILL.md",[],[],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":19},"01M7EXQXW7C7PGREJW9ZZTZ16H","changelog","Auto-generates a changelog from git commits, sprint data, and design documents. Produces both internal and player-facing versions.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fchangelog\u002FSKILL.md",[],[],{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":78,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":116,"publishedAt":19},"01M7EXQMH2ZME3ANN8Q8MEWPFB","cellxgene-census","Query the CZ CELLxGENE Census programmatically for versioned public single-cell and spatial transcriptomics data. Use when you need population-scale cell metadata, gene expression slices, Census summary counts, source H5AD URIs\u002Fdownloads, embeddings, spatial Census data, or reference atlas comparisons across organisms, tissues, diseases, assays, and cell types. For analyzing your own local single-cell data use scanpy, anndata, or scvi-tools.","https:\u002F\u002Fgithub.com\u002Flza6\u002FArmor-piercing-system-prompts\u002Fblob\u002Fmain\u002F05-技能与代理开发\u002Fcellxgene-census\u002FSKILL.md",[],[]]