Azure Sign-in Success with Legacy Client User-Agent Indicators (MFA Bypass Suspicion)
Alerts on successful Azure sign-ins using legacy client user-agent markers that may indicate MFA bypass attempts.
- Product
- azure
- Service
- signinlogs
- Author
- Harjot Singh, '@cyb3rjy0t' (SigmaHQ), DRL 1.1
- Published
- 2023-03-20
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags successful Azure sign-ins whose user-agent contains legacy client authentication indicators while the sign-in status is Success. Attackers may use legacy client flows to attempt bypassing MFA controls, often tied to credential-stuffing or password-spray patterns. The detection relies on Azure sign-in logs, specifically the sign-in outcome and the user-agent string.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20230217071802/https://blooteem.com/march-2022
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Azure Sign-in Success with Legacy Client User-Agent Indicators (MFA Bypass Suspicion)
id: e6fc0b91-1434-4896-a8ac-21ea849ed748
status: test
description: This rule flags successful Azure sign-ins whose user-agent contains legacy client authentication indicators while the sign-in status is Success. Attackers may use legacy client flows to attempt bypassing MFA controls, often tied to credential-stuffing or password-spray patterns. The detection relies on Azure sign-in logs, specifically the sign-in outcome and the user-agent string.
references:
- https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022
- https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml
author: Harjot Singh, '@cyb3rjy0t', Huntrule Team
date: 2023-03-20
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.credential-access
- attack.stealth
- attack.t1078.004
- attack.t1110
logsource:
product: azure
service: signinlogs
detection:
selection:
Status: Success
userAgent|contains:
- BAV2ROPC
- CBAinPROD
- CBAinTAR
condition: selection
falsepositives:
- Known Legacy Accounts
level: high
license: DRL-1.1
related:
- id: 53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc
type: derived