AN1423
Analytic 1423
Containers
Access and retrieval of container service account tokens followed by unauthorized API requests using those tokens to interact with the Kubernetes API server or internal services.
kubernetes:audit
GET or LIST requests to /var/run/secrets/kubernetes.io/serviceaccount/ followed by access to the Kubernetes API server
[TimeWindow]
Adjust based on how quickly tokens are expected to be used post-access
[UserContext]
Tuning for known service accounts that legitimately access the API
AN1424
Analytic 1424
IaaS
Token retrieval from instance metadata endpoints such as AWS IMDS or Azure IMDS, followed by API usage using the obtained token from non-standard applications.
AWS:CloudTrail
GetInstanceIdentityDocument or IMDSv2 token requests
AWS:CloudTrail
Use of temporary credentials issued from IMDS access
[UserAgent]
May need tuning for known automation tools versus unexpected curl usage
[TimeWindow]
Correlate retrieval and use of token within expected timeout window
AN1425
Analytic 1425
Identity Provider
Unusual OAuth app registration followed by user-granted OAuth tokens and subsequent high-privilege resource access via those tokens.
azure:audit
App registrations or consent grants by abnormal users or at unusual times
[ConsentScope]
Tunable based on risky or privileged scopes in the environment
[AppUserRatio]
Threshold of how many users have authorized a given app
AN1426
Analytic 1426
Office Suite
Use of OAuth tokens by third-party apps to access user mail, calendar, or SharePoint resources where the token was granted recently or via spearphishing.
m365:unified
App-only or delegated access patterns where client_id != known enterprise apps
[ClientAppIDAllowList]
Defenders may allow known app IDs, flag unknowns
[AccessVolumeThreshold]
Rate of resource access by a newly consented app
AN1427
Analytic 1427
SaaS
Programmatic access to user content via stolen access tokens in platforms like Slack, GitHub, Google Workspace — especially from new IPs, apps, or excessive resource access.
saas:googleworkspace
Access via OAuth credentials with unusual scopes or from anomalous IPs
saas:slack
OAuth token use by unknown app client_id accessing private channels or files
[GeoVelocity]
Flag when token use appears across geographically distant logins
[OAuthScopeSensitivity]
Weight certain scopes (admin, file.read) as higher risk