AN0954
Analytic 0954
Windows
Use of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events.
WinEventLog:Security
EventCode=4624, 4648
WinEventLog:Sysmon
EventCode=1
[TimeWindow]
Allows tuning of how far apart related logon and process events can be correlated
[UserContext]
Customize for high-value or service accounts with restricted access policies
AN0955
Analytic 0955
Linux
Access tokens or SSH keys used without corresponding login shell or PAM module activity, particularly for remote execution.
auditd:SYSCALL
execution of ssh, scp, or sftp using previously unseen credentials or keys
NSM:Connections
Accepted publickey for user from unusual IP or without tty
[SourceIPWhitelist]
Tune for approved jump boxes or bastion hosts
[AuthMethod]
Filter on use of password vs publickey methods for better coverage
AN0956
Analytic 0956
Identity Provider
Token replay or impersonation in federated logins without interactive browser session or MFA prompts.
azure:signinlogs
TokenIssuanceStart, TokenIssuanceSuccess
m365:unified
login using refresh_token with no preceding authentication context
[MFAContextRequired]
Customize for accounts where MFA must always precede token issuance
[RefreshTokenReuseThreshold]
Threshold for number of times a refresh token is reused without re-auth
AN0957
Analytic 0957
SaaS
Unusual reuse of OAuth access tokens from different geographic regions, without full login events.
saas:googleworkspace
access_token issued
saas:googleworkspace
API access without user login
[GeoIPDistanceThreshold]
Minimum distance between token reuse events to trigger detection
AN0958
Analytic 0958
Containers
Container process uses mounted cloud credentials or token cache to authenticate without known orchestration.
docker:runtime
execution of cloud CLI tool (e.g., aws, az) inside container
AWS:CloudTrail
AssumeRole
[ContainerLabel]
Restrict to prod workloads or certain namespaces
[CredentialPath]
Path used to mount sensitive tokens (e.g., /.aws/credentials)
AN0959
Analytic 0959
Office Suite
Access token reuse to connect to SharePoint or Outlook APIs without interactive user context.
m365:unified
TokenIssued, FileAccessed
[UserAgentCheck]
Tune to detect access from CLI agents or scripts rather than interactive browsers
AN0960
Analytic 0960
IaaS
Use of instance metadata tokens across instances or misuse of short-lived tokens issued for different roles.
AWS:CloudTrail
GetCallerIdentity
AWS:CloudTrail
AssumeRole
[TokenReuseWindow]
Time window where token reuse is suspicious
[RoleMismatchAlerting]
Enable if tokens for RoleA are used in resources only RoleB should access