User Access Blocked by Azure Conditional Access

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

Sigma rule (View on GitHub)

 1title: User Access Blocked by Azure Conditional Access
 2id: 9a60e676-26ac-44c3-814b-0c2a8b977adf
 3status: test
 4description: |
 5    Detect access has been blocked by Conditional Access policies.
 6    The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.    
 7references:
 8    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
 9author: AlertIQ
10date: 2021/10/10
11modified: 2022/12/25
12tags:
13    - attack.credential_access
14    - attack.initial_access
15    - attack.t1110
16    - attack.t1078.004
17logsource:
18    product: azure
19    service: signinlogs
20detection:
21    selection:
22        ResultType: 53003
23    condition: selection
24falsepositives:
25    - Unknown
26level: medium

References

Related rules

to-top