← Back to SOC feed Coverage →

UpdateStsRefreshToken[Solorigate]

kql MEDIUM Azure-Sentinel
CloudAppEvents
backdoorhuntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-08T11:00:00Z · Confidence: medium

Hunt Hypothesis

Unusual modifications to Active Directory STS refresh tokens by non-DirectorySync service principals may indicate adversary attempts to compromise authentication mechanisms. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect potential credential theft or persistence tactics used by advanced threats.

KQL Query

CloudAppEvents 
| where ActionType == "Update StsRefreshTokenValidFrom Timestamp."
| where RawEventData !has "Directorysync"
| extend displayName = RawEventData.ModifiedProperties[0].Name  
| where displayName == "StsRefreshTokensValidFrom"
| extend oldValue = RawEventData.ModifiedProperties[0].OldValue
| extend newValue = RawEventData.ModifiedProperties[0].NewValue
| extend oldStsRefreshValidFrom = todatetime(parse_json(tostring(oldValue))[0])
| extend newStsRefreshValidFrom = todatetime(parse_json(tostring(newValue))[0])
| extend tokenMinutesAdded = datetime_diff('minute',newStsRefreshValidFrom,oldStsRefreshValidFrom)
| extend tokenMinutesRemaining = datetime_diff('minute',Timestamp,newStsRefreshValidFrom)
| extend Role = parse_json(RawEventData.Actor[-1]).ID
| distinct AccountObjectId, AccountDisplayName, tostring(Role), IPAddress, IsAnonymousProxy, ISP, tokenMinutesAdded, tokenMinutesRemaining

Analytic Rule Definition

id: 634dfbd6-0a42-40da-854e-2161cf137f14
name: UpdateStsRefreshToken[Solorigate]
description: |
  This will show Active Directory Security Token Service (STS) refresh token modifications by Service Principals and Applications other than DirectorySync. Refresh tokens are used to validate identification and obtain access tokens. This event is most often generated when legitimate administrators troubleshoot frequent Entra ID user sign-ins but may also be generated as a result of malicious token extensions. Confirm that the activity is related to an administrator legitimately modifying STS refresh tokens and check the new token validation time period for high values.
  Query insprired by Azure Sentinel detection https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/StsRefreshTokenModification.yaml
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
- Defense evasion
tags:
- Solorigate
query: |
  CloudAppEvents 
  | where ActionType == "Update StsRefreshTokenValidFrom Timestamp."
  | where RawEventData !has "Directorysync"
  | extend displayName = RawEventData.ModifiedProperties[0].Name  
  | where displayName == "StsRefreshTokensValidFrom"
  | extend oldValue = RawEventData.ModifiedProperties[0].OldValue
  | extend newValue = RawEventData.ModifiedProperties[0].NewValue
  | extend oldStsRefreshValidFrom = todatetime(parse_json(tostring(oldValue))[0])
  | extend newStsRefreshValidFrom = todatetime(parse_json(tostring(newValue))[0])
  | extend tokenMinutesAdded = datetime_diff('minute',newStsRefreshValidFrom,oldStsRefreshValidFrom)
  | extend tokenMinutesRemaining = datetime_diff('minute',Timestamp,newStsRefreshValidFrom)
  | extend Role = parse_json(RawEventData.Actor[-1]).ID
  | distinct AccountObjectId, AccountDisplayName, tostring(Role), IPAddress, IsAnonymousProxy, ISP, tokenMinutesAdded, tokenMinutesRemaining

Required Data Sources

Sentinel TableNotes
CloudAppEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Defense evasion/UpdateStsRefreshToken[Solorigate].yaml