Hardening Entra ID: Blue Team Token Protection Guide

Overview & Defensive Context: Entra ID Token Theft & Pass-the-PRT (T1528)#

Harden Entra ID against Pass-the-PRT: enforce Conditional Access Token Protection, enable Credential Guard, and deploy CAE session revocation.

In our morning threat analysis, we deconstructed the offensive mechanics of the Pass-the-PRT attack (mapped to MITRE ATT&CK T1528: Steal Application Access Token and T1556: Modify Authentication Process). We analyzed how adversaries with local administrative privileges on Windows endpoints extract the Primary Refresh Token (PRT) and its accompanying Session Key from the CloudAP authentication package inside the Local Security Authority Subsystem Service (lsass.exe). By calculating HMAC-SHA256 signatures offline using the derived session key, attackers synthesize valid PRT cookies (x-ms-RefreshTokenCredential) and replay them from unauthorized external devices.

For identity architects, enterprise administrators, and blue teams, defending Microsoft Entra ID environments against Pass-the-PRT reveals fundamental limitations in legacy access control paradigms:

The Inherent Flaw of Bearer Tokens: Standard OAuth 2.0 refresh tokens are bearer tokens. Whoever possesses the token string and presents valid proof-of-possession can redeem it from anywhere in the world. Traditional Conditional Access policies evaluate claims at the moment of token presentation, blind to the physical hardware that originated the request.
The Compliance Inherited-Trust Vulnerability: When an attacker steals a PRT from an Intune-compliant, hybrid-joined laptop, the token already encapsulates verified claims for Multi-Factor Authentication (amr: ["pwd", "mfa"]) and device compliance (isCompliant: true). Replaying the token completely bypasses Conditional Access policies designed to block unmanaged or non-compliant devices.
The Hardware TPM Misconception: While TPM 2.0 chips securely store device private keys, the operational session key used for routine single sign-on is unsealed into LSASS virtual memory to avoid hardware cryptographic bottlenecks. Attackers dumping LSASS easily extract the unsealed session key, rendering the TPM hardware useless as an isolation boundary unless explicit token binding is enforced.
Delayed Session Invalidation: Traditional refresh tokens maintain rolling validities of up to 14 days (and maximum session lifetimes of 90 days). Without Continuous Access Evaluation (CAE) and proactive session revocation, an exfiltrated PRT grants persistent, silent cloud access even after an endpoint has been removed from the corporate network.

Warning

Standard MFA prompts and device compliance policies do NOT prevent Pass-the-PRT attacks. If refresh tokens are not cryptographically bound to hardware through Conditional Access Token Protection, stolen tokens will successfully authenticate from attacker-controlled systems. Blue teams must enforce Token Protection, enable Windows Credential Guard, and configure real-time Continuous Access Evaluation.

⚔️ Exploitation Mechanics: For root-cause memory corruption analysis and attack flow, see our deep-dive: Deconstructing Breakdown.

Architecture Hardening: Multi-Layered Token Protection Defense-in-Depth#

Neutralizing Pass-the-PRT and protecting Entra ID tokens requires a comprehensive four-tier defense-in-depth architecture: Conditional Access Token Protection, Host-Level LSASS Isolation (Credential Guard & RunAsPPL), Continuous Access Evaluation (CAE), and Identity Protection Risk Policies.

Defense Architecture Flowchart#

flowchart TD
    classDef client fill:#1e293b,stroke:#ef4444,stroke-width:2px,color:#f8fafc
    classDef gate fill:#0f172a,stroke:#3b82f6,stroke-width:2px,color:#93c5fd
    classDef cloud fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#6ee7b7
    classDef audit fill:#4c1d95,stroke:#8b5cf6,stroke-width:2px,color:#ddd6fe
    classDef drop fill:#450a0a,stroke:#dc2626,stroke-width:2px,color:#fca5a5
    classDef pass fill:#065f46,stroke:#34d399,stroke-width:2px,color:#a7f3d0

    ClientAuth[Client Requests Token at login.microsoftonline.com]:::client --> CAGate{Tier 1: Conditional Access Policy Evaluation}:::gate

    CAGate -- Policy Requires Token Protection --> TokenProtCheck{Token Protection Hardware Binding Verification}:::gate
    CAGate -- Standard Policy Without Token Protection --> LegacyFlow[Legacy Bearer Evaluation: Vulnerable to Replay]:::drop

    TokenProtCheck -- Stolen Bearer Token Replayed from Foreign Device --> DropToken[Action: Block Access & Require Device-Bound Token]:::drop
    TokenProtCheck -- Valid TPM-Bound Hardware Proof Verified --> CAEEval{Tier 2: Continuous Access Evaluation Gate}:::cloud

    CAEEval -- User Critical Event Detected or IP Out-of-Bounds --> RevokeCAE[Action: Real-Time Session Invalidation]:::drop
    CAEEval -- Active User & Device Posture Healthy --> EndpointGate{Tier 3: Host Endpoint Security Controls}:::cloud

    EndpointGate -- LSA Protection RunAsPPL & Credential Guard Active --> ShieldLSASS[LSASS Process Isolated in VBS Trustlet]:::pass
    EndpointGate -- Unprotected LSASS: Process Memory Dump Attempted --> DumpLSA[Vulnerability Path: Session Key Leaked]:::drop

    ShieldLSASS --> AccessGranted[Client Authenticates to Microsoft 365 & Graph]:::pass

    DropToken -.-> TelemetryStream[Tier 4: Sentinel & Sign-in Logs Telemetry]:::audit
    RevokeCAE -.-> TelemetryStream
    TelemetryStream --> SOCAlert[SOC Incident Triage Triggered]:::pass

Layer 1: Enforcing Conditional Access Token Protection#

Microsoft introduced Token Protection for Conditional Access (also known as token binding) to eliminate the risk of token theft and replay. When Token Protection is enabled, Entra ID requires that refresh tokens used for target applications (Exchange Online, SharePoint Online, Teams, and Microsoft Graph) are cryptographically bound to the device's hardware TPM.

If an adversary extracts a PRT and session key and attempts to use it from a foreign system, Entra ID detects that the incoming request lacks the hardware-bound proof-of-possession from the registered device TPM and immediately terminates the request with AADSTS50097: Device authentication failed.

To configure Token Protection in the Microsoft Entra Admin Center:

Navigate to Protection > Conditional Access > Policies > New policy.
Users: Assign to all targeted users (ensure break-glass emergency accounts are excluded).
Target resources: Select Cloud apps > Office 365 and Microsoft Remote Desktop.
Conditions > Client apps: Enable Mobile apps and desktop clients.
Session: Check Require token protection for sign-in sessions for all supported applications.
Enable policy: Select On and save.

POWERSHELL

# PowerShell script to verify and audit Token Protection policy deployment via Microsoft Graph
Connect-MgGraph -Scopes "Policy.Read.All", "Policy.ReadWrite.ConditionalAccess"

# Query Conditional Access policies for Token Protection session controls
$Policies = Get-MgIdentityConditionalAccessPolicy -All
$TokenProtectedPolicies = $Policies | Where-Object { 
    $_.SessionControls.SecureSignInSession.IsEnabled -eq $true 
}

if ($TokenProtectedPolicies) {
    Write-Host "[+] Token Protection is ACTIVE across $($TokenProtectedPolicies.Count) policies:" -ForegroundColor Green
    $TokenProtectedPolicies | Select-Object DisplayName, State | Format-Table -AutoSize
} else {
    Write-Warning "[-] WARNING: Zero Conditional Access policies enforce Token Protection! Enterprise remains vulnerable to Pass-the-PRT."
}

Layer 2: Endpoint Isolation: LSA Protection (RunAsPPL) and Credential Guard#

Even with cloud-side token protection, organizations must harden the Windows endpoint to prevent adversaries from accessing LSASS memory where CloudAP tokens reside:

Enable LSA Protection as a Protected Process Light (RunAsPPL): Restricts non-protected processes from reading or writing LSASS virtual memory, blocking offensive memory-dumping utilities (Mimikatz, MiniDumpWriteDump, procdump).
Deploy Windows Defender Credential Guard: Utilizes Virtualization-based Security (VBS) to isolate LSA secrets inside a secure virtualization trustlet (LsaIso.exe). CloudAP encryption keys and domain credentials never reside in the standard Windows kernel address space.
Deploy Attack Surface Reduction (ASR) Rules: Enforce the Microsoft Defender ASR rule Block credential stealing from the Windows local security authority subsystem (lsass.exe) (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2).

Deploy these settings across your enterprise fleet via PowerShell, Intune, or Group Policy:

POWERSHELL

# Endpoint Hardening Script: Enabling LSA Protection and Credential Guard
# 1. Enable LSA Protection (RunAsPPL)
$LsaPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
Set-ItemProperty -Path $LsaPath -Name "RunAsPPL" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $LsaPath -Name "RunAsPPLBoot" -Value 2 -Type DWord -Force

# 2. Enable Virtualization-based Security and Credential Guard
$DeviceGuardPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"
Set-ItemProperty -Path $DeviceGuardPath -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord -Force
Set-ItemProperty -Path $DeviceGuardPath -Name "RequirePlatformSecurityFeatures" -Value 3 -Type DWord -Force # Secure Boot + DMA

$LsaIsoPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
Set-ItemProperty -Path $LsaIsoPath -Name "LsaCfgFlags" -Value 1 -Type DWord -Force # Credential Guard Enabled

# 3. Enable ASR Rule: Block Credential Stealing from LSASS
Add-MpPreference -AttackSurfaceReductionRules_Ids 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 -AttackSurfaceReductionRules_Actions Enabled

Write-Host "[+] LSA RunAsPPL, Credential Guard, and ASR rules configured successfully. Reboot required." -ForegroundColor Green

Layer 3: Enforcing Continuous Access Evaluation (CAE)#

Traditional OAuth access tokens remain valid for an entire hour regardless of user state changes. Continuous Access Evaluation (CAE) (RFC 8414 / OpenID Shared Signals) establishes a real-time event pipeline between Microsoft Entra ID and resource providers (Exchange, SharePoint, Teams).

When CAE is enforced:

Critical events (user account disabled, password reset, admin initiates session revocation, user risk elevates to High) revoke token validity within under 15 minutes (often within seconds).
Real-time network location policies immediately invalidate active sessions if the user's IP address drifts outside trusted corporate named locations.

Ensure CAE is enabled across your tenant under Entra ID > Security > Continuous access evaluation (enabled by default in modern tenants).

Layer 4: Entra ID Identity Protection Risk Policies#

Deploy automated risk-based Conditional Access policies to intercept anomalous token presentations:

User Risk Policy: When Identity Protection flags a user with High Risk (e.g., leaked credentials or detected token theft), automatically require password change and revoke existing refresh tokens.
Sign-in Risk Policy: If an anomalous sign-in occurs from an unfamiliar IP or unfamiliar ASN (characteristic of an attacker replaying an extracted PRT cookie), require step-up MFA or block access entirely.

Production Detection Queries: Sigma Rule, Microsoft Sentinel KQL & Telemetry#

Detecting Pass-the-PRT requires correlating endpoint telemetry (attempts to access LSASS) with cloud authentication anomalies in Microsoft Entra ID Sign-in logs.

1. Production Sigma Rule: LSASS Handle Access for CloudAP Token Extraction#

The following production-validated Sigma rule flags unauthorized processes opening handles to lsass.exe with query or read access permissions, characteristic of offensive tools (ROADtoken, AADInternals, Mimikatz) attempting to steal CloudAP tokens:

YAML

title: LSASS Process Access for CloudAP Primary Refresh Token Theft
id: a749b81e-3c22-48a1-b541-8e9c9e015528
status: production
description: |
    Detects unauthorized process handle requests to lsass.exe characteristic of 
    credential extraction tools attempting to harvest the Entra ID Primary Refresh 
    Token (PRT) and session keys from the CloudAP authentication package.
references:
    - https://learn.microsoft.com/en-us/entra/identity/devices/concept-primary-refresh-token
    - https://aadinternals.com/post/prt/
    - https://attack.mitre.org/techniques/T1528/

tags:
    - attack.credential_access
    - attack.t1003.001
    - attack.t1528
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 10
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess|contains:
            - '0x10'   # PROCESS_VM_READ
            - '0x1410' # PROCESS_VM_READ | PROCESS_QUERY_INFORMATION
            - '0x1FFFFF' # PROCESS_ALL_ACCESS
    filter_trusted_system:
        SourceImage|endswith:
            - '\system32\csrss.exe'
            - '\system32\services.exe'
            - '\system32\svchost.exe'
            - '\system32\msiexec.exe'
            - '\Program Files\Windows Defender\MsMpEng.exe'
            - '\Program Files\CrowdStrike\CSFalconService.exe'
            - '\Program Files\SentinelOne\SentinelAgent.exe'
    condition: selection and not filter_trusted_system
fields:
    - Computer
    - SourceImage
    - TargetImage
    - GrantedAccess
    - CallTrace
falsepositives:
    - Legitimate endpoint backup agents or vulnerability scanners inspecting LSASS.
level: high

2. Microsoft Sentinel KQL Query: Detecting Replayed PRT IP & ASN Discrepancies#

When an attacker replays a stolen PRT cookie from an external machine, the resulting non-interactive sign-in log in Entra ID preserves the original deviceId from the compliant endpoint but records the attacker's public IP address and Autonomous System Number (ASN).

Execute this KQL hunting query in Microsoft Sentinel to detect device-to-IP divergence:

KQL

// KQL Query: Hunting for Stolen PRT Replay Across Divergent Networks
SigninLogs
| where TimeGenerated >= ago(24h)
| where ResultType == 0 // Successful sign-in
| extend DeviceId = tostring(DeviceDetail.deviceId)
| extend TrustType = tostring(DeviceDetail.trustType)
| extend DeviceOS = tostring(DeviceDetail.operatingSystem)
| where isnotempty(DeviceId) and TrustType in ("AzureAd", "ServerAd")
| summarize 
    DistinctIPCount = dcount(IPAddress),
    IPAddresses = make_set(IPAddress),
    DistinctASNs = dcount(AutonomousSystemNumber),
    ASNs = make_set(AutonomousSystemNumber),
    Locations = make_set(LocationDetails.countryOrRegion),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by UserPrincipalName, DeviceId, DeviceOS
| where DistinctIPCount > 1 and DistinctASNs > 1
| extend TimeDeltaMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| where TimeDeltaMinutes < 120
| project UserPrincipalName, DeviceId, DeviceOS, DistinctIPCount, IPAddresses, DistinctASNs, ASNs, Locations, TimeDeltaMinutes
| order by DistinctIPCount desc

3. Microsoft Sentinel KQL Query: Failed Token Protection Enforcements#

Monitor sign-in logs for failed token binding requests, which indicate that an adversary attempted to redeem a stolen token against a resource protected by Token Protection:

KQL

// KQL Query: Detecting Blocked Stolen Token Replays via Token Protection
SigninLogs
| where TimeGenerated >= ago(7d)
| where ResultType in (50097, 53000) // AADSTS50097: Device authentication failed / Token Protection failure
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location, ResultDescription, DeviceDetail
| order by TimeGenerated desc

Enterprise Mitigation Matrix: Workarounds, Hotfixes & Architecture#

When prioritizing defensive engineering against Pass-the-PRT, security leadership must balance rapid host hardening against enterprise-wide Conditional Access deployment:

Remediation Strategy	Implementation Effort	Blast Radius & Operational Risk	Detection & Prevention Efficacy	Performance Overhead	Architectural Longevity
Workaround: Enable Windows LSA RunAsPPL & ASR Rules	1 - 2 Hours (Deploy registry keys via GPO or Intune device configuration profiles)	Low May impact legacy smart-card or third-party authentication credential providers.	High (85%) Prevents unprivileged and standard admin tools from dumping LSASS memory.	Negligible Native OS kernel protection.	Tactical Barrier Essential endpoint baseline; bypassable via BYOVD or kernel drivers.
Operational Control: Windows Credential Guard (VBS)	1 - 2 Days (Enable Virtualization-based Security across endpoint fleet)	Low - Moderate Requires UEFI Secure Boot and hardware virtualization support.	High (95%) Isolates CloudAP secrets in secure VBS trustlets outside kernel access.	< 1% Hardware virtualization overhead.	Mandatory Standard Permanently closes userspace and kernel memory scraping paths.
Cloud Fix: Conditional Access Token Protection	1 - 2 Weeks (Configure and pilot Token Protection session controls in Conditional Access)	Moderate Requires modern Windows versions (Windows 10 20H2+ / Windows 11); client must support WAM.	Absolute Against Replay (100%) Cryptographically binds refresh tokens to TPM; foreign replay fails instantly.	Zero Cloud-side token validation.	Core Identity Pillar Permanently neutralizes bearer token theft across Microsoft 365.
Architecture Fix: Continuous Access Evaluation & FIDO2 Phishing-Resistant MFA	4 - 8 Weeks (Deploy FIDO2 security keys, enforce CAE, and establish strict IP boundaries)	Substantial Requires deploying hardware tokens and updating administrative workflows.	Comprehensive (100%) Prevents initial credential compromise and enables instant cloud revocation.	Negligible Modern zero-trust standard.	Permanent State Zero-trust identity architecture fully resilient to token theft.

Important

Token Protection specifically protects Refresh Tokens (PRTs). Short-lived Access Tokens (which have a default lifetime of 60 to 90 minutes) are not hardware-bound once issued. To minimize the blast radius of access token exfiltration, combine Token Protection with Continuous Access Evaluation (CAE) to ensure rapid, event-driven revocation.

Incident Response & Verification Playbook: Pass-the-PRT Triage & Eradication#

If a compromised Primary Refresh Token or unauthorized cloud access via Pass-the-PRT is suspected, execute the following four-phase incident response playbook immediately:

flowchart TD
    classDef alert fill:#450a0a,stroke:#dc2626,stroke-width:2px,color:#fca5a5
    classDef check fill:#1e293b,stroke:#f59e0b,stroke-width:2px,color:#fef3c7
    classDef triage fill:#0f172a,stroke:#3b82f6,stroke-width:2px,color:#93c5fd
    classDef clean fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#6ee7b7

    Triage[Phase 1: Forensic Sign-in Audit & Device Correlation]:::triage --> VerifyIP{Check SigninLogs for IP/Device Discrepancies}:::check

    VerifyIP -- Discrepant External IP with Legitimate Device ID --> IsolateEndpoint[Phase 2: Immediate Endpoint Isolation & Disconnection]:::alert
    VerifyIP -- Normal Sign-in Baseline --> CheckSysmon{Check Sysmon Event 10 for LSASS Handle Access}:::check

    CheckSysmon -- Unauthorized Process Read LSASS --> IsolateEndpoint
    CheckSysmon -- Clean Telemetry --> CloseIncident[Close Incident as False Positive]:::clean

    IsolateEndpoint --> RevokeSessions[Phase 3: Revoke All User Refresh Tokens via Graph API]:::alert
    RevokeSessions --> ResetPassword[Reset User Password & Re-enroll MFA Devices]:::alert
    ResetPassword --> ReimageDevice[Reimage Endpoint & Re-enroll in Intune]:::alert

    ReimageDevice --> Phase4[Phase 4: Post-Remediation Verification & Policy Audit]:::clean

Query Microsoft Entra Sign-in Logs for the Compromised Account: Inspect all recent interactive and non-interactive sign-in events for the affected user over the past 7 days:

POWERSHELL

# Forensic inspection of user sign-in sessions via Microsoft Graph SDK
Connect-MgGraph -Scopes "AuditLog.Read.All", "User.Read.All"

$TargetUser = "user@target-corp.com"
$Signins = Get-MgAuditLogSignIn -Filter "userPrincipalName eq '$TargetUser'" -Top 50

$Signins | Select-Object CreatedDateTime, AppDisplayName, IPAddress, 
    @{N='City'; E={$_.Location.City}}, 
    @{N='Country'; E={$_.Location.CountryOrRegion}}, 
    @{N='DeviceName'; E={$_.DeviceDetail.DisplayName}}, 
    @{N='TrustType'; E={$_.DeviceDetail.TrustType}}, 
    Status | Format-Table -AutoSize

Inspect Host Endpoint for LSASS Memory Access: Query Sysmon Event ID 10 logs on the user's primary endpoint to confirm whether tools opened read handles to lsass.exe:

POWERSHELL

Get-WinEvent -FilterHashtable @{
    LogName   = 'Microsoft-Windows-Sysmon/Operational'
    Id        = 10
    StartTime = (Get-Date).AddDays(-3)
} | Where-Object { $_.Properties[1].Value -like "*lsass.exe*" } | Format-List TimeCreated, Message

Phase 2: Immediate Containment & Host Isolation#

Isolate the Compromised Endpoint via Defender for Endpoint: Prevent lateral movement by isolating the device from the corporate network:

POWERSHELL

# Isolate device via Microsoft Defender for Endpoint API
Invoke-MgGraphRequest -Method POST -Uri "https://api.securitycenter.microsoft.com/api/machines/$MachineId/isolate" -Body @{
    Comment = "Isolating host due to suspected Pass-the-PRT LSASS extraction"
    IsolationType = "Full"
}

Revoke All Active User Sessions Immediately: Invalidate all active refresh tokens, PRT cookies, and session states in Microsoft Entra ID:

POWERSHELL

# Invalidate all active user sessions across Microsoft 365
Revoke-MgUserSignInSession -UserId $TargetUser
Write-Host "[+] All refresh tokens and active sessions revoked for $TargetUser." -ForegroundColor Green

Phase 3: Credential Eradication & Remediation#

Reset Account Password: Reset the user's password, which triggers automated token invalidation across legacy authentication endpoints:

POWERSHELL

Update-MgUser -UserId $TargetUser -PasswordProfile @{
    ForceChangePasswordNextSignIn = $true
    Password = (New-Guid).Guid
}

Audit and Re-Enroll MFA Methods: Inspect registered authentication methods to verify that the adversary did not register rogue FIDO2 keys or Authenticator apps:

POWERSHELL

Get-MgUserAuthenticationMethod -UserId $TargetUser | Select-Object Id, AdditionalProperties

Reimage the Compromised Endpoint: Because the attacker possessed administrative privileges capable of dumping LSASS, wipe and reimage the host through Windows Autopilot to eliminate persistent malware or rootkits.

Phase 4: Post-Remediation Verification & Hardening Checklist#

Before concluding incident response and restoring access:

Confirm that Revoke-MgUserSignInSession was executed successfully and that old session cookies are rejected.
Verify that the user successfully authenticated using an interactive, phishing-resistant MFA method.
Confirm that Conditional Access Token Protection is active for the user's assigned security group.
Verify that the reimaged endpoint has LSA Protection (RunAsPPL) and Credential Guard confirmed active:

POWERSHELL

# Verify Credential Guard and LSA status
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object SecurityServicesRunning

Deploy the production Sigma rule a749b81e-3c22-48a1-b541-8e9c9e015528 into your endpoint monitoring pipeline.
Confirm that the Microsoft Sentinel KQL detection query is scheduled and alerting on anomalous device IP discrepancies.

Executive Takeaway Table#

Attack Vector / Phase	Forensic Detection Signal	Primary Defensive Mitigation
Local LSASS / CloudAP Dumping	Sysmon Event ID 10 targeting `lsass.exe` with `0x10` or `0x1410` access mask.	Enable LSA Protection (RunAsPPL) and Windows Defender Credential Guard.
Offline PRT Cookie Synthesis	Anomalous unauthenticated requests to `/oauth2/token` requesting `grant_type=srv_challenge`.	Deploy Entra ID Identity Protection to flag anomalous token challenge requests.
Foreign Device Replay	Entra ID Sign-in logs show compliant `deviceId` originating from external, unmanaged IP/ASN.	Enforce Conditional Access Token Protection (cryptographically binding tokens to TPM).
Conditional Access MFA Bypass	Sign-in logs indicate MFA and Compliance claims satisfied from foreign geolocation.	Enforce Continuous Access Evaluation (CAE) with strict IP network boundaries.
Post-Compromise Cloud Persistence	Unauthorized Graph API or Exchange Online data exfiltration activity.	Execute immediate session revocation via `Revoke-MgUserSignInSession`.

Authoritative References#

Microsoft Learn Documentation: What is a Primary Refresh Token (PRT)? — Microsoft Learn
Microsoft Learn Documentation: Token Protection in Microsoft Entra Conditional Access — Microsoft Learn
Microsoft Security Guidance: Protecting Tokens in Microsoft Entra ID — Microsoft Learn
Dirk-jan Mollema Research: Abusing Azure AD SSO with the Primary Refresh Token — ROADtools Research
MITRE ATT&CK Framework: Technique T1528: Steal Application Access Token — MITRE ATT&CK

Hardening Entra ID: Blue Team Token Protection Guide

Overview & Defensive Context: Entra ID Token Theft & Pass-the-PRT (T1528)#

Architecture Hardening: Multi-Layered Token Protection Defense-in-Depth#

Defense Architecture Flowchart#

Layer 1: Enforcing Conditional Access Token Protection#

Layer 2: Endpoint Isolation: LSA Protection (RunAsPPL) and Credential Guard#

Layer 3: Enforcing Continuous Access Evaluation (CAE)#

Layer 4: Entra ID Identity Protection Risk Policies#

Production Detection Queries: Sigma Rule, Microsoft Sentinel KQL & Telemetry#

1. Production Sigma Rule: LSASS Handle Access for CloudAP Token Extraction#

2. Microsoft Sentinel KQL Query: Detecting Replayed PRT IP & ASN Discrepancies#

3. Microsoft Sentinel KQL Query: Failed Token Protection Enforcements#

Enterprise Mitigation Matrix: Workarounds, Hotfixes & Architecture#

Incident Response & Verification Playbook: Pass-the-PRT Triage & Eradication#

Phase 2: Immediate Containment & Host Isolation#

Phase 3: Credential Eradication & Remediation#

Phase 4: Post-Remediation Verification & Hardening Checklist#

Executive Takeaway Table#

Authoritative References#

Comments

Post a Comment

Hardening Entra ID: Blue Team Token Protection Guide

Overview & Defensive Context: Entra ID Token Theft & Pass-the-PRT (T1528)#

Architecture Hardening: Multi-Layered Token Protection Defense-in-Depth#

Defense Architecture Flowchart#

Layer 1: Enforcing Conditional Access Token Protection#

Layer 2: Endpoint Isolation: LSA Protection (RunAsPPL) and Credential Guard#

Layer 3: Enforcing Continuous Access Evaluation (CAE)#

Layer 4: Entra ID Identity Protection Risk Policies#

Production Detection Queries: Sigma Rule, Microsoft Sentinel KQL & Telemetry#

1. Production Sigma Rule: LSASS Handle Access for CloudAP Token Extraction#

2. Microsoft Sentinel KQL Query: Detecting Replayed PRT IP & ASN Discrepancies#

3. Microsoft Sentinel KQL Query: Failed Token Protection Enforcements#

Enterprise Mitigation Matrix: Workarounds, Hotfixes & Architecture#

Incident Response & Verification Playbook: Pass-the-PRT Triage & Eradication#

Phase 1: Live Triage & Forensic Sign-in Audit#

Phase 2: Immediate Containment & Host Isolation#

Phase 3: Credential Eradication & Remediation#

Phase 4: Post-Remediation Verification & Hardening Checklist#

Executive Takeaway Table#

Authoritative References#

Comments

Post a Comment