Azure AD Sign-ins by Unknown Devices from Non-Trusted Locations

title: Azure AD Sign-ins by Unknown Devices from Non-Trusted Locations
id: b8f082e7-4ed9-48af-ad8b-dd1c8197812b
status: test
description: This rule flags Azure sign-in events where the authentication requirement is single-factor, the sign-in result is successful, and the device identifier is missing/unknown. Attackers often rely on abnormal or unrecognized device context to blend into routine activity or to continue access from unmanaged endpoints. The detection relies on Azure sign-in log fields for device details, result type, authentication requirement, and network location details.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_unknown_devices.yml
author: Michael Epping, '@mepples21', Huntrule Team
date: 2022-06-28
modified: 2022-10-05
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078.004
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    AuthenticationRequirement: singleFactorAuthentication
    ResultType: 0
    NetworkLocationDetails: "[]"
    DeviceDetail.deviceId: ""
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 4d136857-6a1a-432a-82fc-5dd497ee5e7c
    type: derived