Unbound Token Usage from High-Risk Apps
hunt-2025-036 v1.0 Entra created Paul Newton
Hypothesis
Threat Actors will use token theft as a means of initial access, privilege escalation and persistence. Poorly secured tokens by third parties can increase the risk of token theft and replay.
Unbound Token Usage from High-Risk Apps
This analytic looks at cases where a non-interactive authentication session occurs, where the token protection status is unbound. It looks for where these authentications occur against specific, high risk Microsoft Apps, from a list of specific "browser" types.
KQL
AADNonInteractiveUserSignInLogs
| extend TokenProtection = parse_json(TokenProtectionStatusDetails)
| extend SessionStatus = tostring(TokenProtection.signInSessionStatus)
| where SessionStatus == "unbound"
| where ResourceDisplayName in ("Microsoft Graph", "Office 365 Exchange Online", "Office 365 SharePoint Online")
| extend
DeviceDetailParsed = parse_json(DeviceDetail),
LocationDetailParsed = parse_json(LocationDetails)
| extend
Browser = tostring(DeviceDetailParsed.browser),
DeviceId = tostring(DeviceDetailParsed.deviceId),
Location = tostring(LocationDetailParsed.countryOrRegion)
| where Browser contains "Python" or Browser contains "curl" or Browser contains "PostmanRuntime"
| project
TimeGenerated,
UserDisplayName,
AppDisplayName,
ResourceDisplayName,
IPAddress,
Location,
Browser,
DeviceId,
IncomingTokenType,
SessionStatus"
Triage steps
- 1 Verify the token session status is truly unbound and not protected
- 2 Review the browser/UserAgent field - Python, curl, or PostmanRuntime may indicate automated tools
- 3 Investigate why the application is authenticating with unbound tokens
- 4 Check if the application has the offline_access permission scope
- 5 Review what Microsoft resources were accessed (Graph, Exchange, SharePoint)
- 6 Verify if the application is authorized and has legitimate business use
- 7 Check if there are other authentications from the same app with similar patterns
- 8 Recommend implementing token protection policies if the app supports it
True positive example
- TimeGenerated
- 06/12/2025, 18:40:37.848
- UserDisplayName
- Hunter
- AppDisplayName
- TruffleHog Test App
- ResourceDisplayName
- Microsoft Graph
- IPAddress
- 79.135.105.18
- Location
- AZ
- Browser
- Python Requests 2.31
- DeviceId
- IncomingTokenType
- refreshToken
- SessionStatus
- unbound
Unbound token being used with Python automation tool to access Microsoft Graph. The lack of device binding combined with a non-standard browser indicates potential token replay from an attacker-controlled system.