ASOS Breach: How a Single Compromised SaaS Identity Becomes a Network Intrusion — Detection and Hardening Guide

---
title: Suspicious OAuth Application Consent Grant
id: 3f8a2b14-6c1d-4e92-b7a5-9d0e1f2a3b4c
status: experimental
description: Detects user or admin consent granted to OAuth applications with high-risk permission scopes, a common persistence technique following SaaS identity compromise.
references:
  - https://attack.mitre.org/techniques/T1528/
  - https://attack.mitre.org/techniques/T1550/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1528
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    operationName: 'Consent to application'
  filter_high_risk_scopes:
    targetResources|contains:
      - 'Mail.Read'
      - 'Mail.Send'
      - 'Files.ReadWrite.All'
      - 'Directory.ReadWrite.All'
      - 'offline_access'
  condition: selection and filter_high_risk_scopes
falsepositives:
  - Legitimate enterprise app onboarding — maintain an allowlist of approved app IDs
level: high
---
title: Session Token Access to Browser Credential Stores
id: 8c4d1e67-2a9b-4f35-cd80-1e2f3a4b5c6d
status: experimental
description: Detects non-browser processes accessing browser cookie and credential stores, indicative of session token theft used to hijack SaaS identities without a password or MFA prompt.
references:
  - https://attack.mitre.org/techniques/T1539/
  - https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1539
  - attack.t1555.003
logsource:
  category: file_access
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\Default\Cookies'
      - '\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies'
      - '\AppData\Local\Microsoft\Edge\User Data\Default\Cookies'
      - '\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies'
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\MsMpEng.exe'
  condition: selection_path and not filter_browsers
falsepositives:
  - EDR/AV scans — tune per your tooling's process paths
  - Backup agents accessing user profiles
level: high

// Hunt 1: Impossible travel / token replay indicators in Entra sign-ins
let lookback = 7d;
SigninLogs
| where TimeGenerated > ago(lookback)
| where ResultType == 0
| summarize Locations = make_set(Location), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            IPAddresses = make_set(IPAddress), AuthMethods = make_set(AuthenticationRequirement)
    by UserPrincipalName, AppDisplayName, bin(TimeGenerated, 1h)
| where array_length(Locations) > 1
| where array_length(IPAddresses) > 2
| project TimeGenerated, UserPrincipalName, AppDisplayName, Locations, IPAddresses, AuthMethods
| order by TimeGenerated desc;

// Hunt 2: OAuth consent grants preceded by sign-in from a new ASN/country
let NewConsent = AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName == 'Consent to application'
| mv-expand TargetResources
| extend AppId = tostring(TargetResources.id)
| extend Scopes = tostring(TargetResources.modifiedProperties)
| where Scopes has_any ('Mail.Read','Mail.Send','Files.ReadWrite','Directory.ReadWrite','offline_access')
| project ConsentTime = TimeGenerated, UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName), AppId, Scopes, IPAddress = tostring(InitiatedBy.user.ipAddress);
let BaselineCountries = SigninLogs
| where TimeGenerated > ago(30d) and TimeGenerated < ago(1d)
| summarize by UserPrincipalName, Location;
NewConsent
| join kind=inner (SigninLogs | where TimeGenerated > ago(24h) | project UserPrincipalName, SignInLocation = Location, SignInIP = IPAddress, SignInTime = TimeGenerated) on UserPrincipalName
| join kind=leftanti BaselineCountries on UserPrincipalName, $left.SignInLocation == $right.Location
| project ConsentTime, UserPrincipalName, AppId, Scopes, SignInLocation, SignInIP;

// Hunt 3 (Defender XDR): Non-browser processes touching browser cookie stores
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ('Cookies','Login Data','Local State')
| where FolderPath has_any ('\Chrome\User Data\','\Edge\User Data\','\Firefox\Profiles\')
| where InitiatingProcessFileName !in~ ('chrome.exe','msedge.exe','firefox.exe','MsMpEng.exe','MsSense.exe')
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, AccountName
| order by TimeGenerated desc;

-- Hunt for non-browser processes accessing browser cookie/credential stores
SELECT Pid,
       Name AS ProcessName,
       Exe AS ProcessPath,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(cookies|login data|local state|\\User Data\\)'
  AND Name !~ '(?i)(chrome|msedge|firefox|msmpeng|mssense)'

-- Also enumerate cookie store files with recent modification (potential staging for theft)
SELECT FullPath,
       Size AS FileSize,
       Mtime AS ModifiedTime
FROM glob(globs='C:\\Users\\*\\AppData\\Local\\*\\*\\User Data\\Default\\Network\\Cookies')
WHERE Mtime > now() - 86400

# Connect with scopes required for identity containment
Connect-MgGraph -Scopes 'User.ReadWrite.All','Directory.Read.All','Application.Read.All','AuditLog.Read.All' -NoWelcome

# === STEP 1: Revoke all sessions/refresh tokens for the compromised identity ===
# Replace with the UPN of the suspected compromised account
$TargetUser = 'compromised.user@yourdomain.com'
Revoke-MgUserSignInSession -UserId $TargetUser
Write-Host "[+] Sessions and refresh tokens revoked for $TargetUser" -ForegroundColor Green

# === STEP 2: Force password reset on next sign-in ===
$PasswordProfile = @{ ForceChangePasswordNextSignIn = $true; ForceChangePasswordNextSignInWithMfa = $true }
Update-MgUser -UserId $TargetUser -PasswordProfile $PasswordProfile
Write-Host "[+] Forced password reset with MFA re-registration set for $TargetUser" -ForegroundColor Green

# === STEP 3: Enumerate OAuth consent grants with high-risk scopes ===
$HighRiskScopes = 'Mail.Read','Mail.Send','Files.ReadWrite.All','Directory.ReadWrite.All','offline_access','full_access_as_app'
$Grants = Get-MgOauth2PermissionGrant -All
foreach ($Grant in $Grants) {
    foreach ($Scope in $HighRiskScopes) {
        if ($Grant.Scope -match [regex]::Escape($Scope)) {
            $SP = Get-MgServicePrincipal -ServicePrincipalId $Grant.ClientId -ErrorAction SilentlyContinue
            Write-Host "[!] HIGH-RISK CONSENT: App=$($SP.DisplayName) ClientId=$($Grant.ClientId) Scope=$($Grant.Scope) ConsentType=$($Grant.ConsentType)" -ForegroundColor Red
        }
    }
}

# === STEP 4: List service principals created in the last 30 days (persistence check) ===
$Cutoff = (Get-Date).AddDays(-30)
Get-MgServicePrincipal -All | Where-Object { $_.AdditionalProperties.createdDateTime -and ([datetime]$_.AdditionalProperties.createdDateTime) -gt $Cutoff } |
    Select-Object DisplayName, AppId, Id | Format-Table -AutoSize

# === STEP 5: Audit recent sign-in risk for the target user ===
Get-MgRiskDetection -Filter "userPrincipalName eq '$TargetUser'" -All -ErrorAction SilentlyContinue |
    Select-Object RiskType, RiskLevel, RiskState, DetectedDateTime, IpAddress, Location |
    Format-Table -AutoSize

Write-Host "[*] Containment steps complete. Review high-risk consents and disable unauthorized apps via: Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId <id>" -ForegroundColor Yellow