skills.rest
msandbu
msandbuCOMMUNITY
Explore all skills by this author →
GitHub

authentication-tracing

Analyze Microsoft Entra ID authentication flows to detect token theft.

2|Updated Mar 4, 2026
Search Tags:#security#authentication#incident response#forensics#entra id#token theft
One-click install
npx skills add https://github.com/msandbu/sentinelday --skill authentication-tracing-msandbu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: authentication-tracing
Source: https://github.com/msandbu/sentinelday/tree/main/.github/skills/authentication-tracing
Command: npx skills add https://github.com/msandbu/sentinelday --skill authentication-tracing-msandbu

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps security analysts distinguish between legitimate user activity and malicious credential or token theft by forensically analyzing authentication flows in Microsoft Entra ID.

Core Features & Use Cases

  • Forensic Analysis: Deep dive into Entra ID authentication chains to identify the origin and legitimacy of sign-ins.
  • Token Reuse Detection: Differentiate between active MFA challenges and the reuse of stolen tokens.
  • Geographic Anomaly Investigation: Assess sign-ins from suspicious locations by correlating IP enrichment data with authentication patterns.
  • Use Case: When an alert flags a sign-in from an unusual country, this Skill can trace the authentication chain to determine if the user performed MFA at that location or if a stolen token was used, providing critical context for incident response.

Quick Start

Use the authentication-tracing skill to trace the authentication chain for the user '[email protected]' associated with the suspicious IP address '192.0.2.1'.

Frequently Asked Questions about authentication-tracing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I trace Entra ID authentication flows to detect token theft?▼

Trace Entra ID authentication flows by correlating SigninLogs and AADNonInteractiveUserSignInLogs to investigate SessionId chains, distinguishing legitimate MFA challenges from stolen token reuse.

What is the difference between interactive MFA and token reuse in Microsoft Entra ID logs?▼

Distinguishing interactive MFA from token reuse requires analyzing SessionId chains in Entra ID logs to verify if the user actively completed a challenge or if a previously stolen token was used non-interactively.

How do I investigate suspicious sign-ins from unusual geographic locations in Entra ID?▼

Investigate geographic anomalies in Entra ID sign-ins by correlating IP enrichment data with authentication patterns to determine if the location matches legitimate user behavior or token theft.

Do I need AADNonInteractiveUserSignInLogs for Microsoft Entra ID forensics?▼

Yes, AADNonInteractiveUserSignInLogs are required for Entra ID forensics alongside SigninLogs to perform detailed event correlation and analyze token reuse across the authentication chain.

Can I analyze SessionId chains to verify legitimate user activity in Entra ID?▼

Yes, analyzing SessionId chains allows you to trace the origin and legitimacy of sign-ins, verifying whether the authentication pattern reflects legitimate user activity or malicious credential theft.

What is the best way to perform incident response forensics on Microsoft Entra ID authentication?▼

Perform Entra ID incident response forensics by tracing authentication chains, analyzing token reuse versus active MFA, and assessing geographic anomalies using IP enrichment data for critical context.

Related Skills

Explore More Software Engineering Skills→
SCStelzSCStelz
231

authentication-tracing

Trace Entra ID authentication flows to distinguish fresh MFA from token reuse.

Community
Advanced
YukiIto1999YukiIto1999

detecting-oauth-token-theft

Detect OAuth token theft and replay attacks in Entra ID sign-in logs.

Community
Intermediate
msandbumsandbu
2

geomap-visualization

Generates interactive geographic maps of IP addresses to visualize attack origins and security events.

Community
Advanced
Steffen025Steffen025
186

SECUpdates

Aggregate security news into a ranked digest with categories and source attribution.

Community
Advanced