{"id":"13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc","title":"Azure Login Bypassing Conditional Access Policies","description":"Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.\n","author":"Josh Nickels, Marius Rothenbücher","status":"experimental","level":"high","date":"2025-01-08","modified":"","tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078"],"technique_ids":["T1078"],"logsource":{"service":"audit","product":"m365"},"falsepositives":["Unknown"],"references":["https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/","https://github.com/JumpsecLabs/TokenSmith"],"source_path":"rules/cloud/m365/audit/microsoft365_bypass_conditional_access.yml","source_sha256":"10a3fb8a8240ea72d29290bf7f75853a3e2c84a53e52721a90dd8f1485f175ab","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/m365/audit/microsoft365_bypass_conditional_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Azure Login Bypassing Conditional Access Policies\nid: 13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc\nstatus: experimental\ndescription: |\n    Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.\nauthor: Josh Nickels, Marius Rothenbücher\nreferences:\n    - https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/\n    - https://github.com/JumpsecLabs/TokenSmith\ndate: 2025-01-08\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.initial-access\n    - attack.stealth\n    - attack.t1078\nlogsource:\n    service: audit\n    product: m365\ndetection:\n    selection:\n        Operation: 'UserLoggedIn'\n        ApplicationId: '9ba1a5c7-f17a-4de9-a1f1-6178c8d51223'\n        ResultStatus: 'Success'\n        RequestType: 'Cmsi:Cmsi'\n    filter_main_bjectid:\n        ObjectId: '0000000a-0000-0000-c000-000000000000' # Microsoft Intune seen when mobile devices are enrolled\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"}],"data_path":"data/detection-rules/13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc.json","kind":"sigma"}