Authentications To Important Apps Using Single Factor Authentication
Detect when authentications to important application(s) only required single-factor authentication
Sigma rule (View on GitHub)
1title: Authentications To Important Apps Using Single Factor Authentication
2id: f272fb46-25f2-422c-b667-45837994980f
3status: test
4description: Detect when authentications to important application(s) only required single-factor authentication
5references:
6 - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts
7author: MikeDuddington, '@dudders1'
8date: 2022-07-28
9tags:
10 - attack.initial-access
11 - attack.t1078
12logsource:
13 product: azure
14 service: signinlogs
15detection:
16 selection:
17 Status: 'Success'
18 AppId: 'Insert Application ID use OR for multiple'
19 AuthenticationRequirement: 'singleFactorAuthentication'
20 condition: selection
21falsepositives:
22 - If this was approved by System Administrator.
23level: medium
References
Related rules
- AWS Suspicious SAML Activity
- Account Tampering - Suspicious Failed Logon Reasons
- Activity From Anonymous IP Address
- Application Using Device Code Authentication Flow
- Applications That Are Using ROPC Authentication Flow