OAuth2 Token Burst — Token Harvesting (Microsoft Defender for Identity)
Detects a sudden surge in OAuth2 token requests or acquisitions within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate token harvesting activity, where an attacker attempts to obtain multiple access tokens to abuse authentication sessions and maintain unauthorized access.
CQL · Falcon Next-Gen SIEMCopy query
#Vendor = "microsoft"
| #event.module = "defender-identity"
| Vendor.category = "AdvancedHunting-IdentityLogonEvents"
| Vendor.properties.LogonType = "OAuth2:Token"
| groupBy([user.name], function=[
count(as=token_requests),
count(field=Vendor.properties.DestinationDeviceName, distinct=true, as=unique_destinations),
collect(fields=[Vendor.properties.DestinationDeviceName,"Vendor.properties.AdditionalFields.ARG.CLOUD_SERVICE",Vendor.properties.Application,source.address]),
min(@timestamp, as=start_time),
max(@timestamp, as=end_time)
])
| token_requests >= 10
| time_diff_min := (end_time - start_time) / 60000
| time_diff_min <= 10
| start_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=start_time, timezone="UTC")
| end_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=end_time, timezone="UTC")
| drop([start_time, end_time])
| sort([token_requests], order=desc)Detects a sudden surge in OAuth2 token requests or acquisitions within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate token harvesting activity, where an attacker attempts to obtain multiple access tokens to abuse authentication sessions and maintain unauthorized access.
oauth2_token_burst_token_harvesting_microsoft_defender_for_identity.yml
T1528
Kundan Kumar
Detection
Identity
Identity
2026-05-21
2026-05-21
