Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent

  1[metadata]
  2creation_date = "2026/05/27"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects Microsoft Entra ID sign-in activity where the Microsoft Authentication Broker authenticates is using a user agent 
 11that is not consistent with common browser, mobile, or Windows platform authentication clients. Adversary-in-the-middle and OAuth phishing
 12tooling often presents scripted or relayed user agents (for example Node.js, Python, or generic HTTP libraries) while
 13still targeting first-party resources through the broker.
 14"""
 15false_positives = [
 16    """
 17    Legitimate automation, SDKs, or custom applications that obtain tokens through the Microsoft Authentication Broker
 18    against Graph, Azure AD, or Device Registration Service may use non-browser user agents. Baseline approved
 19    service principals, managed identities, and developer tooling before tuning exclusions for known automation
 20    patterns.
 21    """,
 22]
 23from = "now-9m"
 24index = ["logs-azure.signinlogs-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent"
 28note = """## Triage and analysis
 29
 30### Investigating Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent
 31
 32Review `azure.signinlogs.properties.user_principal_name`, `user_agent.original`,
 33`azure.signinlogs.properties.resource_display_name`, `azure.signinlogs.properties.session_id`, `source.ip`, and
 34`source.as.organization.name`.
 35
 36Confirm whether the user or application intentionally used a non-browser client against the requested resource.
 37
 38### Possible investigation steps
 39
 40- Inspect `user_agent.original` for automation libraries (for example `node`, `axios`, `python-requests`, `curl`).
 41- Correlate `azure.signinlogs.properties.session_id` with other sign-ins, device registration audit events, or Graph
 42  activity in the same time window.
 43- Review conditional access outcomes and identity protection signals for the user.
 44- Compare `source.ip` and ASN against expected VPN, MDM, and developer egress.
 45
 46### False positive analysis
 47
 48- Microsoft platform and mobile clients using Mozilla-, Dalvik-, CFNetwork-, or Windows-AzureAD-Authentication-Provider-
 49  style user agents are excluded by design.
 50- First-party CLI tools and test harnesses that legitimately broker tokens may still match if they use uncommon user
 51  agent strings.
 52
 53### Response and remediation
 54
 55- If malicious, revoke refresh tokens for the user, review newly registered devices, and reset credentials per policy.
 56- Escalate when paired with suspicious ASN sign-ins, multi-IP OAuth flows, or follow-on Graph data access.
 57"""
 58references = [
 59    "https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/",
 60    "https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/",
 61    "https://any.run/malware-trends/tycoon/",
 62]
 63risk_score = 73
 64rule_id = "c22f89d9-b674-4650-8454-02242c8b35eb"
 65severity = "high"
 66setup = """
 67Microsoft Entra ID sign-in logs (`logs-azure.signinlogs-*`) must populate `user_agent.original`,
 68`azure.signinlogs.properties.app_display_name`, and `azure.signinlogs.properties.resource_display_name`.
 69"""
 70tags = [
 71    "Domain: Cloud",
 72    "Domain: Identity",
 73    "Data Source: Azure",
 74    "Data Source: Microsoft Entra ID",
 75    "Data Source: Microsoft Entra ID Sign-In Logs",
 76    "Use Case: Threat Detection",
 77    "Tactic: Initial Access",
 78    "Tactic: Credential Access",
 79    "Resources: Investigation Guide",
 80    "Noise: Low",
 81    "Performance: Normal",
 82    "Profile: Recommended",
 83    "Threat: AiTM Phishing",
 84    "Rule Type: Custom Query (KQL)",
 85    "Platform: Entra ID",
 86]
 87timestamp_override = "event.ingested"
 88type = "query"
 89
 90query = '''
 91data_stream.dataset:"azure.signinlogs" and event.action:"Sign-in activity" and event.outcome:(success or Success) and 
 92(azure.signinlogs.properties.app_display_name:"Microsoft Authentication Broker" or azure.signinlogs.properties.app_id:"29d9ed98-a469-4536-ade2-f981bc1d605e") and
 93user_agent.original:(* and not (Mozilla* or Dalvik* or *CFNetwork* or Windows-AzureAD-Authentication-Provider* or Java*ThinkPad*)) and
 94azure.signinlogs.properties.resource_display_name:*
 95'''
 96
 97[rule.investigation_fields]
 98field_names = [
 99    "@timestamp",
100    "user.name",
101    "user_agent.original",
102    "source.ip",
103    "source.as.number",
104    "source.as.organization.name",
105    "source.geo.country_name",
106    "event.outcome",
107    "azure.signinlogs.properties.user_principal_name",
108    "azure.signinlogs.properties.session_id",
109    "azure.signinlogs.properties.app_display_name",
110    "azure.signinlogs.properties.app_id",
111    "azure.signinlogs.properties.resource_display_name",
112    "azure.signinlogs.properties.resource_id",
113    "azure.signinlogs.properties.authentication_protocol",
114    "azure.tenant_id",
115]
116
117[[rule.threat]]
118framework = "MITRE ATT&CK"
119
120[[rule.threat.technique]]
121id = "T1566"
122name = "Phishing"
123reference = "https://attack.mitre.org/techniques/T1566/"
124
125[[rule.threat.technique.subtechnique]]
126id = "T1566.002"
127name = "Spearphishing Link"
128reference = "https://attack.mitre.org/techniques/T1566/002/"
129
130[rule.threat.tactic]
131id = "TA0001"
132name = "Initial Access"
133reference = "https://attack.mitre.org/tactics/TA0001/"
134
135[[rule.threat]]
136framework = "MITRE ATT&CK"
137
138[[rule.threat.technique]]
139id = "T1078"
140name = "Valid Accounts"
141reference = "https://attack.mitre.org/techniques/T1078/"
142
143[[rule.threat.technique.subtechnique]]
144id = "T1078.004"
145name = "Cloud Accounts"
146reference = "https://attack.mitre.org/techniques/T1078/004/"
147
148[rule.threat.tactic]
149id = "TA0005"
150name = "Defense Evasion"
151reference = "https://attack.mitre.org/tactics/TA0005/"
152
153[[rule.threat]]
154framework = "MITRE ATT&CK"
155
156[[rule.threat.technique]]
157id = "T1539"
158name = "Steal Web Session Cookie"
159reference = "https://attack.mitre.org/techniques/T1539/"
160
161[rule.threat.tactic]
162id = "TA0006"
163name = "Credential Access"
164reference = "https://attack.mitre.org/tactics/TA0006/"