Primary Refresh Token (PRT) theft
Device-bound Entra PRT abused to mint tokens for any app
categoryIdentity, authentication and credential attacksseverityHighdetectabilityHighlabnot yet measured
Classification
31 values: 17 imported, 1 derived, 13 machine-classified. What do these mean?
Exploitability
| Attack vector | Credential attacks |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | High |
| Resources required | Low |
| Likelihood / prevalence | Medium |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | ContainersIaaSIdentity ProviderLinuxOffice SuiteSaaSWindows |
| Environment | Hybrid |
| Target asset class | Identity |
| Kill-chain phase (tactic) | Lateral Movement |
Detection & telemetry
| Detectability | High |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Application Log ContentLogon Session CreationProcess CreationUser Account AuthenticationWeb Credential Usage |
| Defense bypassed | System access controls |
Detection & response
Mitigated by 39
- M1013 attack-mitigation
- M1015 attack-mitigation
- M1018 attack-mitigation
- M1026 attack-mitigation
- M1027 attack-mitigation
- M1036 attack-mitigation
- M1047 attack-mitigation
D3-ABPId3fendD3-ANCId3fendD3-APCAd3fendD3-CCSAd3fendD3-CHd3fendD3-CRd3fendD3-CROd3fendD3-CSPPd3fendD3-CTSd3fendD3-DUCd3fendD3-HBPId3fendD3-HRd3fendD3-HSd3fendD3-KBPId3fendD3-MFAd3fendD3-NTCDd3fendD3-NTFd3fendD3-NTSAd3fendD3-PHDURAd3fendD3-PLAd3fendD3-PMADd3fendD3-PSd3fendD3-PSAd3fendD3-PSMDd3fendD3-PTd3fendD3-RICd3fendD3-RTSDd3fendD3-SCFd3fendD3-TBd3fendD3-TBAd3fendD3-UGLPAd3fendD3-WSAMd3fend
Detected by 20
- DET0338 attack-detection-strategy
12827a56-61a4-476a-a9cb-f3068f191073sigma192a0330-c20b-4356-90b6-7b7049ae0b87sigma24549159-ac1b-479c-8175-d42aea947caesigma3245cd30-e015-40ff-a31d-5cadd5f377ecsigma7ec2c172-dceb-4c10-92c9-87c1881b7e18sigma8eef149c-bd26-49f2-9e5a-9b00e3af499bsigma905d389b-b853-46d0-9d3d-dea0d3a3cd49sigma94309181-d345-4cbf-b5fe-061769bdf9cbsigma98c3bcf1-56f2-49dc-9d8d-c66cf190238bsigma9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523sigmab2e4a719-3c8f-4d1b-a507-f83c2d56e901sigmab45ab1d2-712f-4f01-a751-df3826969807sigmadef8b624-e08f-4ae1-8612-1ba21190da6bsigmae3f7c841-2a9d-4b5e-c018-d94b3e67f012sigmae54979bd-c5f9-4d6c-967b-a04b19ac4c74sigmae9d4ab66-a532-4ef7-a502-66a9e4a34f5dsigmaf43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0esigmaf8103686-e3e8-46f3-be72-65f7fcb4aa53sigmaf8d98d6c-7a07-4d74-b064-dd4a3c244528sigma
Tested by 5
a2fc4ec5-12c6-4fb4-b661-961f23f359cbatomicdbf38128-7ba7-4776-bedf-cc2eed432098atomiceb05b028-16c8-4ad8-adea-6f5b219da9a9atomicec23cef9-27d9-46e4-a68d-6f75f7b86908atomicf8757545-b00a-4e4e-8cfb-8cfb961ee713atomic
Attack relationships
- Child: Cloud console / session hijack
- Child: Overpass-the-hash / pass-the-key
- Child: Pass-the-hash
- Child: Pass-the-ticket
- Child: Session cookie theft / pass-the-cookie
- Child: Token replay (access / refresh)
Framework references
- Primary source: https://learn.microsoft.com/en-us/entra/identity/devices/concept-primary-refresh-token
- attack: T1550 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 349 of Cyber-Attack-Taxonomy.md
- ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1550 as the nearest framework entries; ids verified to exist in the cached catalogues.
- ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 2 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)