How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

hunting-saas-sso-token-abuse - Skill

Imported from mukul975/anthropic-cybersecurity-skills (skills/hunting-saas-sso-token-abuse/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill hunting-saas-sso-token-abuse. Copyright stays with the author (Apache-2.0).

Hunting SaaS SSO Token Abuse

Overview

Adversaries increasingly bypass MFA not by defeating it but by stealing the artifacts issued after a successful authentication — session cookies, OAuth access/refresh tokens, and Primary Refresh Tokens (PRTs). With a stolen token an attacker replays the existing session ("pass-the-cookie" / token replay), inheriting the victim's authenticated state across federated SaaS without ever prompting for credentials or MFA. Mandiant's M-Trends reporting and Microsoft/Okta incident data both highlight token theft as a dominant cloud lateral-movement technique, mapped to MITRE ATT&CK T1550.001 Use Alternate Authentication Material: Application Access Token.

Detection relies on correlating identity telemetry rather than watching for failed logins. In Microsoft Entra ID the key tables are SigninLogs (interactive), AADNonInteractiveUserSignInLogs (where replayed cookies/refresh tokens commonly surface), and AADServicePrincipalSignInLogs. Entra now exposes linkable identifiers — SessionId and UniqueTokenIdentifier — that let a hunter stitch every artifact derived from one root authentication event together and spot a single session being used from multiple IPs, ASNs, or device fingerprints. In Okta the System Log carries authentication.sso, policy.evaluate_sign_on, and user.session.start events with a deviceToken/session context; the same session token appearing from divergent IPs/user-agents is the tell. Okta Identity Threat Protection (ITP) can natively flag "suspected session hijacking."

This skill provides a hypothesis-driven hunt: baseline normal session behavior, then look for impossible travel within a single session, refresh-token reuse, token use from anomalous infrastructure (hosting/VPS ASNs), and SaaS access patterns inconsistent with the user's device. Source: MITRE ATT&CK T1550.001; Microsoft Entra ID sign-in log documentation; Okta System Log reference; Mandiant M-Trends.

When to Use

Threat hunting for MFA-bypass via stolen tokens/cookies across Entra ID and SaaS
Investigating an alert for impossible travel, anomalous OAuth grant, or token reuse
Validating detection coverage for T1550.001 after a phishing/AiTM incident
Building Sentinel/Splunk/Okta detections for session-token replay
Post-incident hunting to scope SaaS lateral movement from a compromised identity

Prerequisites

Entra ID sign-in logs flowing to a queryable store (Microsoft Sentinel / Log Analytics):

# Confirm the diagnostic settings export SigninLogs + non-interactive logs to a workspace
az monitor diagnostic-settings list --resource \
  /providers/Microsoft.aadiam/diagnosticSettings -o table

Okta System Log access via API or SIEM ingestion:

curl -s -H "Authorization: SSWS $OKTA_API_TOKEN" \
  "https://<org>.okta.com/api/v1/logs?filter=eventType eq \"user.session.start\"&since=2026-06-01T00:00:00Z"

An IP enrichment source (GeoIP + ASN/hosting-provider classification)
Read access to the SIEM (KQL for Sentinel, SPL for Splunk)
Python 3.9+ for the helper script (requests for the Okta API)

Objectives

Baseline normal per-user session behavior (IPs, ASNs, devices, SaaS apps)
Correlate Entra sign-in artifacts by SessionId / UniqueTokenIdentifier
Detect a single session used from multiple IPs/ASNs (token replay)
Detect impossible travel within one authenticated session
Detect refresh-token reuse and anomalous OAuth grants
Hunt Okta System Log for reused session tokens across contexts
Produce findings and feed confirmed patterns into standing detections

MITRE ATT&CK Mapping

ID	Name	Use in this skill
T1550.001	Use Alternate Authentication Material: Application Access Token	Core technique — replaying stolen OAuth tokens/cookies
T1539	Steal Web Session Cookie	The cookie theft that precedes pass-the-cookie replay
T1528	Steal Application Access Token	Acquisition of OAuth tokens via phishing/illicit consent
T1078.004	Valid Accounts: Cloud Accounts	Replayed tokens grant valid-account access to SaaS
T1098.001	Account Manipulation: Additional Cloud Credentials	Follow-on persistence after token abuse

Workflow

1. Correlate Entra sign-in artifacts by session

Stitch interactive, non-interactive, and SP sign-ins for one session to see the full chain.

union SigninLogs, AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(7d)
| where isnotempty(SessionId)
| summarize IPs=make_set(IPAddress), Apps=make_set(AppDisplayName),
            Locations=make_set(tostring(LocationDetails.countryOrRegion)),
            Count=count() by SessionId, UserPrincipalName
| where array_length(IPs) > 1

2. Detect a single session used from multiple ASNs (token replay)

AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| extend ASN = tostring(parse_json(tostring(NetworkLocationDetails))[0].networkType)
| summarize distinctIPs = dcount(IPAddress),
            ipset = make_set(IPAddress) by SessionId, UserPrincipalName
| where distinctIPs >= 2

3. Detect impossible travel within one authenticated session

SigninLogs
| where TimeGenerated > ago(7d)
| project TimeGenerated, UserPrincipalName, IPAddress,
          City=tostring(LocationDetails.city),
          Country=tostring(LocationDetails.countryOrRegion), SessionId
| order by UserPrincipalName, TimeGenerated asc
| serialize
| extend prevCountry = prev(Country), prevTime = prev(TimeGenerated),
         prevUser = prev(UserPrincipalName)
| where UserPrincipalName == prevUser and Country != prevCountry
        and datetime_diff('minute', TimeGenerated, prevTime) < 60

4. Detect token use from hosting/VPS infrastructure

Replayed tokens are frequently used from datacenter ASNs, unlike the user's residential/corporate ranges.

AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0
| extend asnOrg = tostring(parse_json(tostring(AutonomousSystemNumber)))
| where IPAddress in (toscalar(externaldata(ip:string)["<hosting-asn-iplist>"]))
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress

5. Hunt anomalous OAuth grants / illicit consent (token theft precursor)

AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName in ("Consent to application", "Add OAuth2PermissionGrant",
                          "Add delegated permission grant")
| extend app = tostring(TargetResources[0].displayName)
| project TimeGenerated, InitiatedBy, app, Result

6. Hunt the Okta System Log for reused session tokens

A single Okta session (deviceToken) used from divergent IPs/clients indicates hijack.

curl -s -H "Authorization: SSWS $OKTA_API_TOKEN" \
  "https://<org>.okta.com/api/v1/logs?filter=eventType eq \"policy.evaluate_sign_on\"&since=2026-06-15T00:00:00Z" \
  | jq -r '.[] | [.authenticationContext.externalSessionId, .client.ipAddress, .client.userAgent.rawUserAgent] | @tsv' \
  | sort | uniq -c | sort -rn

7. Splunk equivalent for Okta session reuse

index=okta eventType="policy.evaluate_sign_on"
| stats dc(client.ipAddress) as ip_count
        values(client.ipAddress) as ips
        values(client.userAgent.rawUserAgent) as agents
        by authenticationContext.externalSessionId actor.alternateId
| where ip_count > 1

8. Triage and respond

For confirmed token abuse, revoke sessions and rotate, then promote the hunt to a rule.

# Revoke all refresh tokens / sessions for the user in Entra
az rest --method POST \
  --url "https://graph.microsoft.com/v1.0/users/<userId>/revokeSignInSessions"

See scripts/agent.py to pull Okta logs and flag reused session tokens automatically.

Tools and Resources

Resource	Purpose	Link
MITRE ATT&CK T1550.001	Technique reference	https://attack.mitre.org/techniques/T1550/001/
Entra sign-in logs schema	KQL hunting field reference	https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-azure-monitor-sign-ins-log-schema
Azure-Sentinel hunting repo	Community KQL detections	https://github.com/Azure/Azure-Sentinel
Okta System Log API	Event hunting source	https://developer.okta.com/docs/reference/api/system-log/
Mandiant M-Trends	Token-theft threat landscape	https://www.mandiant.com/m-trends
AzureAD-Attack-Defense	PRT/token replay detection guidance	https://github.com/Cloud-Architekt/AzureAD-Attack-Defense

Preventive Controls to Recommend

Detection should pair with controls that make stolen tokens far less useful:

Entra Conditional Access "token protection" binds the sign-in session to the device, so an exfiltrated cookie/PRT cannot be replayed off-device.
Continuous Access Evaluation (CAE) revokes access in near-real-time on risk events instead of waiting for token expiry.
Phishing-resistant MFA (FIDO2/passkeys) blocks the AiTM proxy phishing that harvests tokens in the first place.
Short token lifetimes + refresh-token rotation shrink the replay window and turn refresh-token reuse into an unambiguous compromise signal.
Okta Identity Threat Protection (ITP) flags suspected session hijacking natively.

False-Positive Tuning

Benign cause	Tuning
Corporate VPN/proxy egress (many users, few IPs)	Allowlist known egress IPs/ASNs
Mobile carrier IP rotation	Widen impossible-travel time/distance thresholds
Legitimate multi-device users	Correlate device IDs, not just IPs
Backend/API calls within one session	Exclude expected service principals

Key Indicators

Indicator	Signal
One `SessionId` across multiple IPs/ASNs	Token/cookie replay
Non-interactive sign-in from new datacenter IP	Replayed refresh token
Impossible travel within < 1h	Concurrent session use
Refresh-token reuse after rotation	Strong compromise signal
New OAuth consent to unfamiliar app	Illicit-consent token theft
Okta session token from divergent user-agents	Session hijack

hunting-saas-sso-token-abuse

About

Hunting SaaS SSO Token Abuse

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Workflow

1. Correlate Entra sign-in artifacts by session

2. Detect a single session used from multiple ASNs (token replay)

3. Detect impossible travel within one authenticated session

4. Detect token use from hosting/VPS infrastructure

5. Hunt anomalous OAuth grants / illicit consent (token theft precursor)

6. Hunt the Okta System Log for reused session tokens

7. Splunk equivalent for Okta session reuse

8. Triage and respond

Tools and Resources

Preventive Controls to Recommend

False-Positive Tuning

Key Indicators

Validation Criteria

Install hunting-saas-sso-token-abuse and it becomes one more candidate the router can pick - when it fits.

What it costs to adopt - in engineering time.

One base URL

No vendor lock-in

Failover built in

Use it

Manifest

Reviews