Azure AD Sign-in Success Without MFA Required (Single-Factor Authentication)

title: Azure AD Sign-in Success Without MFA Required (Single-Factor Authentication)
id: ca1d4b00-1132-4323-8664-6e1c46578338
status: test
description: This rule flags successful Azure AD sign-ins where the authentication requirement is set to single-factor authentication rather than MFA. Attackers may use weaker authentication to maintain access while reducing detection opportunities and bypassing stronger controls. It relies on Azure sign-in log fields indicating a successful sign-in and the stated AuthenticationRequirement value.
references:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_only_single_factor_auth_required.yml
author: MikeDuddington, '@dudders1', Huntrule Team
date: 2022-07-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.credential-access
  - attack.stealth
  - attack.defense-impairment
  - attack.t1078.004
  - attack.t1556.006
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    Status: Success
    AuthenticationRequirement: singleFactorAuthentication
  condition: selection
falsepositives:
  - If this was approved by System Administrator.
level: low
license: DRL-1.1
related:
  - id: 28eea407-28d7-4e42-b0be-575d5ba60b2c
    type: derived