signin_logs

Account Disabled or Blocked for Sign in Attempts

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·

Detects when an account is disabled or blocked for sign in but tried to log in

Account Lockout

Aug 12, 2024 · attack.credential-access attack.t1110 ·

Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

Application Using Device Code Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·

Share on:

Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.

Applications That Are Using ROPC Authentication Flow

Aug 12, 2024 · attack.t1078 attack.defense-evasion attack.persistence attack.privilege-escalation attack.initial-access ·

Share on:

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Authentications To Important Apps Using Single Factor Authentication

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detect when authentications to important application(s) only required single-factor authentication

Azure AD Only Single Factor Authentication Required

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1556.006 ·

Share on:

Detect when users are authenticating without MFA being required.

Azure Unusual Authentication Interruption

Aug 12, 2024 · attack.initial-access attack.t1078 ·

Share on:

Detects when there is a interruption in the authentication process.

Device Registration or Join Without MFA

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·

Share on:

Monitor and alert for device registration or join events where MFA was not performed.

Discovery Using AzureHound

Aug 12, 2024 · attack.discovery attack.t1087.004 attack.t1526 ·

Share on:

Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.

Failed Authentications From Countries You Do Not Operate Out Of

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·

Share on:

Detect failed authentications from countries you do not operate out of.

Increased Failed Authentications Of Any Type

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·

Share on:

Detects when sign-ins increased by 10% or greater.

Login to Disabled Account

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·

Share on:

Detect failed attempts to sign in to disabled accounts.

Measurable Increase Of Successful Authentications

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·

Share on:

Detects when successful sign-ins increased by 10% or greater.

Multifactor Authentication Denied

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·

Share on:

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Multifactor Authentication Interrupted

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 attack.t1621 ·

Share on:

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Potential MFA Bypass Using Legacy Client Authentication

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·

Share on:

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Sign-in Failure Due to Conditional Access Requirements Not Met

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1110 attack.t1078.004 ·

Share on:

Define a baseline threshold for failed sign-ins due to Conditional Access failures

Sign-ins by Unknown Devices

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·

Share on:

Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.

Sign-ins from Non-Compliant Devices

Aug 12, 2024 · attack.defense-evasion attack.t1078.004 ·

Share on:

Monitor and alert for sign-ins where the device was non-compliant.

Successful Authentications From Countries You Do Not Operate Out Of

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·

Share on:

Detect successful authentications from countries you do not operate out of.

Suspicious SignIns From A Non Registered Device

Aug 12, 2024 · attack.defense-evasion attack.t1078 ·

Share on:

Detects risky authentication from a non AD registered device without MFA being required.

Use of Legacy Authentication Protocols

Aug 12, 2024 · attack.initial-access attack.credential-access attack.t1078.004 attack.t1110 ·

Share on:

Alert on when legacy authentication has been used on an account

User Access Blocked by Azure Conditional Access

Aug 12, 2024 · attack.credential-access attack.initial-access attack.t1110 attack.t1078.004 ·

Share on:

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

Users Authenticating To Other Azure AD Tenants

Aug 12, 2024 · attack.initial-access attack.t1078.004 ·

Share on:

Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.