Azure AD Sign-in Success from Legacy Client User Agents Suggesting MFA Bypass Risk

title: Azure AD Sign-in Success from Legacy Client User Agents Suggesting MFA Bypass Risk
id: e6fc0b91-1434-4896-a8ac-21ea849ed748
status: test
description: This rule flags successful Azure sign-in events whose user agent contains legacy client authentication identifiers. Attackers may use these legacy clients to attempt MFA bypass or reduce security controls during credential-based attacks such as password spraying. The detection relies on Azure AD sign-in logs for the sign-in status and user-agent string content.
references:
  - https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022
  - https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml
author: Harjot Singh, '@cyb3rjy0t', Huntrule Team
date: 2023-03-20
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.credential-access
  - attack.stealth
  - attack.t1078.004
  - attack.t1110
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    Status: Success
    userAgent|contains:
      - BAV2ROPC
      - CBAinPROD
      - CBAinTAR
  condition: selection
falsepositives:
  - Known Legacy Accounts
level: high
license: DRL-1.1
related:
  - id: 53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc
    type: derived