Entra ID User Sign-in with Unusual Authentication Type

  1[metadata]
  2creation_date = "2025/03/10"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies rare instances of authentication methods for Microsoft Entra ID principal users. An adversary with stolen
 11credentials may attempt to authenticate with an unusual method, which may indicate an attempt to bypass conditional
 12access policies (CAP) and multi-factor authentication (MFA) requirements. The authentication method may not be commonly
 13used by the user based on their historical sign-in activity.
 14"""
 15from = "now-9m"
 16index = ["filebeat-*", "logs-azure.signinlogs-*"]
 17language = "kuery"
 18license = "Elastic License v2"
 19name = "Entra ID User Sign-in with Unusual Authentication Type"
 20note = """## Triage and analysis
 21
 22### Investigating Entra ID User Sign-in with Unusual Authentication Type
 23
 24Identifies rare instances of authentication methods for Microsoft Entra ID principal users. An adversary with stolen credentials may attempt to authenticate with an unusual method, which may indicate an attempt to bypass conditional access policies (CAP) and multi-factor authentication (MFA) requirements. The authentication method may not be commonly used by the user based on their historical sign-in activity.
 25
 26**This is a New Terms rule that focuses on the first occurrence of an Entra ID principal user `azure.signinlogs.properties.user_principal_name` and their authentication method `azure.signinlogs.properties.authentication_details.authentication_method` in the last 14 days.**
 27
 28### Possible investigation steps
 29
 30- Identify the source IP address by reviewing `source.ip`. Determine whether it is associated with known malicious activity, an unexpected location or hosting provider, or approved corporate infrastructure.
 31- Review `azure.signinlogs.properties.user_principal_name` to determine whether the account is privileged or otherwise high value, and compare the sign-in with the user's recent activity.
 32- Examine `azure.signinlogs.properties.authentication_details.authentication_method` and determine whether the method is expected for the user. Review recent authentication-method registration or modification events.
 33- Review `azure.signinlogs.properties.app_id`, `azure.signinlogs.properties.client_app_used`, and the target resource to determine whether the application and access pattern are expected.
 34- Examine device, browser, user-agent, authentication protocol, and token details for signs of an unfamiliar client or session.
 35- Review `azure.signinlogs.properties.authentication_requirement` and the applicable conditional access policies to determine why the sign-in did not require MFA.
 36
 37## False positive analysis
 38
 39### Common benign scenarios
 40- Users enrolling in or switching to a different authentication method may trigger this detection the first time the method is observed.
 41- Automated scripts or applications using non-interactive authentication may trigger this detection, particularly if they rely on legacy authentication protocols recorded in `azure.signinlogs.properties.authentication_protocol`.
 42- Changes to an organization's authentication or conditional access policies may cause a previously unseen authentication method to be recorded for a user.
 43
 44### How to reduce false positives
 45- Exclude known trusted IPs, such as corporate infrastructure, from alerts by filtering `source.ip`.
 46- Exclude known custom applications from `azure.signinlogs.properties.app_id` that are authorized to use non-interactive authentication.
 47- Correlate alerts with approved authentication-method enrollment or policy changes before adding exceptions.
 48
 49## Response and remediation
 50
 51### Immediate actions
 52- Block the source IP address in `source.ip` if determined to be malicious.
 53- If the sign-in is unauthorized, disable the affected account, revoke active sessions and tokens, and reset its credentials.
 54- Ensure basic authentication is disabled for all applications using legacy authentication protocols listed in `azure.signinlogs.properties.authentication_protocol`.
 55- Enable multi-factor authentication (MFA) for impacted accounts to mitigate credential-based attacks.
 56- Review conditional access policies to enforce risk-based authentication and block unauthorized access recorded in `azure.signinlogs.properties.authentication_requirement`.
 57
 58### Long-term mitigation
 59- Implement a zero-trust security model by enforcing least privilege access and continuous authentication.
 60- Regularly review and update conditional access policies to ensure they are effective against evolving threats.
 61- Restrict the use of legacy authentication protocols by disabling authentication methods listed in `azure.signinlogs.properties.client_app_used`.
 62- Regularly audit authentication logs in `azure.signinlogs` to detect abnormal login behavior and ensure early detection of potential attacks.
 63- Regularly rotate client credentials and secrets for applications using non-interactive authentication to reduce the risk of credential theft.
 64"""
 65risk_score = 47
 66rule_id = "9e11faee-fddb-11ef-8257-f661ea17fbcd"
 67severity = "medium"
 68tags = [
 69    "Domain: Cloud",
 70    "Data Source: Azure",
 71    "Data Source: Microsoft Entra ID",
 72    "Data Source: Microsoft Entra ID Sign-In Logs",
 73    "Platform: Entra ID",
 74    "Use Case: Identity and Access Audit",
 75    "Use Case: Threat Detection",
 76    "Tactic: Initial Access",
 77    "Resources: Investigation Guide",
 78    "Noise: Medium",
 79    "Performance: Fast",
 80    "Rule Type: New Terms",
 81    "Domain: Identity",
 82]
 83timestamp_override = "event.ingested"
 84type = "new_terms"
 85
 86query = '''
 87data_stream.dataset: "azure.signinlogs" and event.category: "authentication"
 88    and azure.signinlogs.properties.user_type: "Member"
 89    and not azure.signinlogs.properties.device_detail.browser: *
 90    and not source.as.organization.name: "MICROSOFT-CORP-MSN-AS-BLOCK"
 91    and not azure.signinlogs.properties.authentication_requirement: "multiFactorAuthentication"
 92    and azure.signinlogs.properties.authentication_details.authentication_method:*
 93    and event.outcome:success
 94'''
 95
 96
 97[[rule.threat]]
 98framework = "MITRE ATT&CK"
 99[[rule.threat.technique]]
100id = "T1078"
101name = "Valid Accounts"
102reference = "https://attack.mitre.org/techniques/T1078/"
103[[rule.threat.technique.subtechnique]]
104id = "T1078.004"
105name = "Cloud Accounts"
106reference = "https://attack.mitre.org/techniques/T1078/004/"
107
108
109
110[rule.threat.tactic]
111id = "TA0001"
112name = "Initial Access"
113reference = "https://attack.mitre.org/tactics/TA0001/"
114[[rule.threat]]
115framework = "MITRE ATT&CK"
116[[rule.threat.technique]]
117id = "T1550"
118name = "Use Alternate Authentication Material"
119reference = "https://attack.mitre.org/techniques/T1550/"
120
121[[rule.threat.technique]]
122id = "T1556"
123name = "Modify Authentication Process"
124reference = "https://attack.mitre.org/techniques/T1556/"
125[[rule.threat.technique.subtechnique]]
126id = "T1556.006"
127name = "Multi-Factor Authentication"
128reference = "https://attack.mitre.org/techniques/T1556/006/"
129
130
131
132[rule.threat.tactic]
133id = "TA0005"
134name = "Defense Evasion"
135reference = "https://attack.mitre.org/tactics/TA0005/"
136
137[rule.new_terms]
138field = "new_terms_fields"
139value = [
140    "azure.signinlogs.properties.user_principal_name",
141    "azure.signinlogs.properties.authentication_details.authentication_method",
142]
143[[rule.new_terms.history_window_start]]
144field = "history_window_start"
145value = "now-14d"