Stale Token Used After Password Change or Auth Method Update

10 Stale Token After Password Change

Query

let PasswordChanges =
    AuditLogs
    | where TimeGenerated > ago(24h)
    | where OperationName has_any (
        "Reset password",
        "Change password",
        "User changed password",
        "Admin updated user authentication method",
        "Update Authentication Method",
        "Delete Authentication Method"
      )
    | extend UPN = tostring(TargetResources[0].userPrincipalName)
    | where isnotempty(UPN)
    | summarize ChangeTime = max(TimeGenerated) by UPN;
AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| join kind=inner PasswordChanges on $left.UserPrincipalName == $right.UPN
| where TimeGenerated > ChangeTime
| summarize
    TokensAfterChange = count(),
    IPs               = make_set(IPAddress),
    Countries         = make_set(Location),
    Apps              = make_set(AppDisplayName),
    LastSeen          = max(TimeGenerated),
    FirstTokenAfter   = min(TimeGenerated)
  by UserPrincipalName, ChangeTime
| extend IPAddress = tostring(IPs[0])
| order by TokensAfterChange desc

Explanation

This query is designed to detect suspicious activity in Azure Active Directory (Azure AD) by identifying cases where a user's password or authentication methods have been changed, but non-interactive token refreshes continue to occur afterward. This situation suggests that an attacker might have a refresh token that remains valid even after the password change, allowing them to maintain access.

Here's a simple breakdown of what the query does:

Monitors Password Changes: It looks at the Azure AD Audit Logs for any password changes or updates to authentication methods within the last 24 hours.
Tracks Token Usage: It checks the Azure AD Non-Interactive User Sign-In Logs for any token refreshes that happen after the password or authentication method change.
Identifies Suspicious Activity: If token refreshes are detected after a password change, it indicates that a potentially compromised token is still being used.
Collects Details: The query gathers information about the number of token refreshes, the IP addresses, countries, and applications involved, and the times of the first and last token use after the change.
Generates Alerts: If any such activity is detected, it triggers an alert with details about the user and the suspicious activity, helping security teams to investigate further.
Severity and Techniques: The alert is marked with high severity and is associated with MITRE ATT&CK techniques related to persistence, credential access, and defense evasion.

Overall, this query helps in identifying potential security breaches where an attacker might be using a stale token to bypass security measures like password changes.

Details

David Alonso

Released: July 16, 2026

Tables

AADNonInteractiveUserSignInLogsAuditLogs

Keywords

AzureActiveDirectoryAADNonInteractiveUserSignInLogsAuditLogsUserAccountIPAddressLocationAppDisplayNameUserPrincipalName

Operators

letwherehas_anyextendisnotemptysummarizemaxjoinon==>countmake_setminbytostringorder bydesc

Severity

High

Tactics

PersistenceCredentialAccessDefenseEvasion

MITRE Techniques

T1528 T1078 T1550

Frequency: 1h

Period: 24h

Actions

GitHub

KQL Search