Azure Microsoft Graph Single Session from Multiple IP Addresses

AnalysisType: rule
Filename: azure_graph_session_multiple_ips.py
RuleID: "Azure.Audit.GraphSessionMultipleIPs"
DisplayName: "Azure Microsoft Graph Single Session from Multiple IP Addresses"
Enabled: true
Status: Experimental
LogTypes:
  - Azure.Audit
Severity: Medium
Threshold: 2
DedupPeriodMinutes: 60
Description: >
  Detects when a user signs in to Microsoft Entra ID and subsequently accesses Microsoft Graph from
  a different IP address using the same session ID. This behavior may indicate OAuth application abuse,
  session hijacking, token replay attacks, or adversary-in-the-middle attacks where an attacker has
  obtained a valid session token and is using it from their own infrastructure.
Tags:
  - Initial Access
  - Valid Accounts
  - Use Alternate Authentication Material
Reports:
  MITRE ATT&CK:
    - TA0001:T1078
    - TA0001:T1078.004
    - TA0005:T1550
    - TA0005:T1550.001
Runbook: |
  1. Query Azure.Audit logs for all Microsoft Graph access events with properties:sessionId in the 4 hours around this alert to identify all source IP addresses, user agents, and accessed resources
  2. Compare the geographic locations and ASN information for all distinct callerIpAddress values to determine if they represent different countries, cloud providers, or inconsistent network types
  3. Review Azure.Audit logs for properties:userPrincipalName in the 7 days before this session to identify OAuth consent grants, new application registrations, risky sign-ins, or token issuance events that may indicate initial compromise
Reference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/azure/initial_access_entra_id_graph_single_session_from_multiple_addresses.toml
SummaryAttributes:
  - properties:userPrincipalName
  - callerIpAddress
  - properties:sessionId
  - properties:appDisplayName
Tests:
  - Name: Multiple IP Access to Same Microsoft Graph Session
    ExpectedResult: true
    Log:
      {
        "time": "2025-01-15 09:35:20.456",
        "resourceId": "/tenants/tenant-123/providers/Microsoft.aadiam",
        "operationName": "Sign-in activity",
        "operationVersion": "1.0",
        "category": "SignInLogs",
        "tenantId": "tenant-123",
        "resultType": "Success",
        "resultSignature": "SUCCESS",
        "durationMs": 0,
        "callerIpAddress": "5.5.5.5",
        "correlationId": "graph-session-002",
        "Level": "4",
        "properties":
          {
            "createdDateTime": "2025-01-15T09:35:20.4567890Z",
            "userPrincipalName": "gandalf@lotr.com",
            "userId": "user-123",
            "ipAddress": "5.5.5.5",
            "sessionId": "session-abc-123",
            "resourceDisplayName": "Microsoft Graph",
            "resourceId": "00000003-0000-0000-c000-111111111111",
            "appDisplayName": "Custom Graph App",
            "appId": "app-custom-789",
            "userAgent": "python-requests/2.28.1",
            "isInteractive": true,
            "authenticationProtocol": "oAuth2",
            "conditionalAccessStatus": "success",
          },
        "p_event_time": "2025-01-15 09:35:20.456",
        "p_log_type": "Azure.Audit",
        "p_parse_time": "2025-01-15 09:35:21.000",
        "p_row_id": "row-456",
      }
  - Name: Non-Interactive Sign-In via NonInteractiveUserSignInLogs Category
    ExpectedResult: false
    Log:
      {
        "time": "2026-02-18 07:34:37.443",
        "resourceId": "/tenants/18360841-3f87-44a6-8c9a-3ffc680611a0/providers/Microsoft.aadiam",
        "operationName": "Sign-in activity",
        "operationVersion": "1.0",
        "category": "NonInteractiveUserSignInLogs",
        "tenantId": "18360841-3f87-44a6-8c9a-3ffc680611a0",
        "resultType": "0",
        "resultSignature": "SUCCESS",
        "durationMs": 0,
        "callerIpAddress": "203.0.113.10",
        "correlationId": "6d657aae-f797-466f-8b35-31eb5b7ffde2",
        "Level": "4",
        "properties":
          {
            "createdDateTime": "2026-02-18T07:32:50.552947800Z",
            "userPrincipalName": "jane.doe@example.com",
            "userId": "3b4e2783-2b5d-4f1f-a3d9-ddc0ed1c623f",
            "ipAddress": "203.0.113.10",
            "sessionId": "00baf379-e510-523f-1c0e-346163d4a768",
            "resourceDisplayName": "Microsoft Graph",
            "resourceId": "00000003-0000-0000-c000-000000000000",
            "appDisplayName": "Custom App",
            "appId": "app-noninteractive-test-999",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36",
            "isInteractive": false,
            "signInEventTypes": ["nonInteractiveUser"],
            "authenticationProtocol": "none",
            "conditionalAccessStatus": "notApplied",
          },
        "p_event_time": "2026-02-18 07:34:37.443",
        "p_log_type": "Azure.Audit",
      }
  - Name: Whitelisted Office 365
    ExpectedResult: false
    Log:
      {
        "time": "2025-01-15 10:00:30.789",
        "resourceId": "/tenants/tenant-456/providers/Microsoft.aadiam",
        "operationName": "Sign-in activity",
        "operationVersion": "1.0",
        "category": "SignInLogs",
        "tenantId": "tenant-456",
        "resultType": "Success",
        "resultSignature": "SUCCESS",
        "durationMs": 0,
        "callerIpAddress": "192.0.2.100",
        "correlationId": "office365-001",
        "Level": "4",
        "properties":
          {
            "createdDateTime": "2025-01-15T10:00:30.7890123Z",
            "userPrincipalName": "employee@company.com",
            "userId": "user-456",
            "ipAddress": "192.0.2.100",
            "sessionId": "session-office-456",
            "resourceDisplayName": "Microsoft Graph",
            "resourceId": "00000003-0000-0000-c000-000000000000",
            "appDisplayName": "Office 365",
            "appId": "00000003-0000-0ff1-ce00-000000000000",
            "userAgent": "Microsoft Office/16.0",
            "isInteractive": true,
            "authenticationProtocol": "oAuth2",
            "conditionalAccessStatus": "success",
          },
        "p_event_time": "2025-01-15 10:00:30.789",
        "p_log_type": "Azure.Audit",
      }