Detecting Identity and Cloud Attacks: Session Theft, OAuth Abuse and IAM

As attackers shift to AiTM phishing, token theft, OAuth consent abuse and cloud IAM attacks, detection moves to sign-in logs, audit logs and cloud control-plane telemetry. This pack lists the anomalies and example logic. Because these attacks use valid credentials and tokens, detection depends on behavioural anomalies rather than failed logins.

Signals at a Glance

Token Replay & Impossible Travel

A stolen session cookie or token produces a session that does not match the user’s device or geography. Hunt sign-in logs for the same user active from two distant locations in an implausible window, or a token presented from a new ASN minutes after a legitimate sign-in:

// Microsoft Sentinel (KQL) - new-ASN reuse after sign-in
SigninLogs
| where ResultType == 0
| summarize asns = make_set(AutonomousSystemNumber), locs = make_set(Location),
            logins = count() by UserPrincipalName, bin(TimeGenerated, 1h)
| where array_length(asns) > 1
| where logins > 1

Then alert on post-sign-in account-manipulation: a newly registered MFA method or a new inbox rule forwarding mail externally is a classic business-email-compromise follow-on.

OAuth Consent & IAM

• Alert on “Consent to application” audit events for apps requesting sensitive Graph scopes (Mail.Read, offline_access, full_access_as_app) or from unverified publishers, and on new service-principal credentials being added.
• In cloud, detect instance-metadata (IMDS) role credentials used from an IP outside the issuing instance, new admin role/policy assignments, and anomalous bulk reads; for S3, alert on SSE-C PutObject bursts and lifecycle-rule changes (the Codefinger pattern).
• Enrich with threat intel: correlate logins with credentials seen in infostealer dumps for your domains.