Azure Token Cache Access Or Staging Attempt

Query

// Hunting rule: explicit attempts to copy, read, or archive Azure token caches.
// This is process-command-line telemetry, not proof of a successful cache read.
let lookback = 7d;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where isnotempty(ProcessCommandLine)
| extend CommandLine = tolower(ProcessCommandLine)
| where
	(
		CommandLine contains "azurermcontext.json"
		or CommandLine contains "msal_token_cache"
		or CommandLine contains "accesstokens.json"
		or CommandLine contains "tokenbroker\\cache"
		or CommandLine contains "azure\\accounts"
		or CommandLine contains "microsoft.aad.brokerplugin"
	)
	and
	(
		CommandLine contains "copy-item"
		or CommandLine contains "compress-archive"
		or CommandLine contains "get-content"
		or CommandLine contains "readalltext"
		or CommandLine contains "readallbytes"
		or CommandLine contains "copy "
		or CommandLine contains "xcopy"
		or CommandLine contains "robocopy"
		or CommandLine contains "7z"
		or CommandLine contains "rar "
		or CommandLine contains "tar "
	)
| project
	Timestamp,
	DeviceName,
	DeviceId,
	AccountName,
	FileName,
	FolderPath,
	ProcessCommandLine,
	ProcessId,
	SHA1,
	InitiatingProcessFileName,
	InitiatingProcessCommandLine,
	InitiatingProcessParentFileName,
	ReportId
| order by Timestamp desc

About this query

Azure Token Cache Access or Staging Attempt

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1539	Steal Web Session Cookie	https://attack.mitre.org/techniques/T1539
T1005	Data from Local System	https://attack.mitre.org/techniques/T1005
T1560	Archive Collected Data	https://attack.mitre.org/techniques/T1560

Description

Detects process command lines attempting to copy, read, or archive Azure token caches, configuration files, or broker plugin data (such as msal_token_cache, azurermcontext.json, accesstokens.json) using utilities like PowerShell, Robocopy, Xcopy, or archiving tools.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

References

BruCon Continuous Access Evasion Evading Microsoft CAE from Nikhil Mittal

Defender XDR

Explanation

This query is designed to detect suspicious activities related to accessing or copying Azure token caches and related configuration files. It looks for specific command-line activities that might indicate an attempt to steal or manipulate Azure authentication tokens. Here's a simple breakdown of what the query does:

Time Frame: It examines events from the past 7 days.
Data Source: The query focuses on DeviceProcessEvents, which logs process activities on devices.
Command Line Filtering: It filters for processes where the command line includes references to specific Azure-related files or directories, such as azurermcontext.json, msal_token_cache, accesstokens.json, and others related to Azure token storage.
Suspicious Actions: It further filters for command lines that include actions typically associated with copying or archiving files, such as using copy-item, compress-archive, xcopy, robocopy, and various archiving tools like 7z, rar, and tar.
Output: The query outputs details about these suspicious processes, including the timestamp, device name, account name, file and folder paths, process command line, and other relevant identifiers.
Purpose: The goal is to identify potential attempts to steal or manipulate Azure authentication tokens, which could be part of a broader cyber attack strategy.

This query is part of a security monitoring effort to detect and respond to potential threats involving Azure token caches, which are critical for maintaining secure access to Azure resources.