Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Use of Legacy Authentication Protocols

Alert on when legacy authentication has been used on an account

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Yochana HendersonCreated Fri Jun 1760f6535a-760f-42a9-be3f-c9a0a025906ecloud
Log Source
Azuresigninlogs
ProductAzure← raw: azure
Servicesigninlogs← raw: signinlogs
Detection Logic
Detection Logic1 selector
detection:
    selection:
        ActivityDetails: Sign-ins
        ClientApp:
            - Other client
            - IMAP
            - POP3
            - MAPI
            - SMTP
            - Exchange ActiveSync
            - Exchange Web Services
        Username: 'UPN'
    condition: selection
False Positives

User has been put in acception group so they can use legacy authentication

References
1
Resolving title…
learn.microsoft.com
MITRE ATT&CK
Rule Metadata
Rule ID
60f6535a-760f-42a9-be3f-c9a0a025906e
Status
test
Level
high
Type
Detection
Created
Fri Jun 17
Author
Yochana Henderson
Path
rules/cloud/azure/signin_logs/azure_legacy_authentication_protocols.yml
Raw Tags
attack.privilege-escalationattack.persistenceattack.defense-evasionattack.initial-accessattack.credential-accessattack.t1078.004attack.t1110
View on GitHub