User Access Blocked by Azure Conditional Access

calendar Oct 12, 2023 · attack.credential_access attack.initial_access attack.t1110 attack.t1078.004  ·
Share on: linkedin copy

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

Sigma rule (View on GitHub)

 1title: User Access Blocked by Azure Conditional Access
 2id: 9a60e676-26ac-44c3-814b-0c2a8b977adf
 3status: test
 4description: |
 5    Detect access has been blocked by Conditional Access policies.
 6    The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.    
 7references:
 8    - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts
 9author: AlertIQ
10date: 2021/10/10
11modified: 2022/12/25
12tags:
13    - attack.credential_access
14    - attack.initial_access
15    - attack.t1110
16    - attack.t1078.004
17logsource:
18    product: azure
19    service: signinlogs
20detection:
21    selection:
22        ResultType: 53003
23    condition: selection
24falsepositives:
25    - Unknown
26level: medium

References

Related rules

to-top