Azure Login Bypassing Conditional Access Policies

Title: Azure Login Bypassing Conditional Access Policies
Status: experimental
Description:Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
References:
  -https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/
  -https://github.com/JumpsecLabs/TokenSmith
Author: Josh Nickels, Marius Rothenbücher
Date: 2025-01-08
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.initial-access'
• -'attack.stealth'
• -'attack.t1078'

Logsource:

• service: audit
• product: m365

Detection:
  selection:
    Operation: 'UserLoggedIn'
    ApplicationId: '9ba1a5c7-f17a-4de9-a1f1-6178c8d51223'
    ResultStatus: 'Success'
    RequestType: 'Cmsi:Cmsi'
  filter_main_bjectid:
    ObjectId: '0000000a-0000-0000-c000-000000000000'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high