In the Huntress token-spraying campaign, attackers kept access through registered Entra devices and their own authenticator app, both of which survive a password reset, and access tokens stay valid for roughly 90 minutes unless sessions are revoked.

• Contain: revoke the user's sessions and reset the password, then remove devices and MFA methods the user doesn't recognize.
• Prevent: require MFA or block for all users, all cloud apps and all client app types; restrict device-code flow with a Conditional Access authentication-flows policy; turn off user consent to new enterprise apps.
• Review: look for MFA cleared and re-registered within minutes, inbox rules with one-to-three-character or punctuation names, and new enterprise app grants.