Azure Sign-in Authentication Interruption via Device and External Security Challenge Failures

title: Azure Sign-in Authentication Interruption via Device and External Security Challenge Failures
id: 377addde-dbdb-41a5-be01-cfa882f38c8c
status: test
description: This rule flags Azure sign-in events where authentication is interrupted, using specific sign-in ResultType and ResultDescription values indicating device authentication requirements, device authentication failure, or an unsatisfied external security challenge. Attackers may trigger repeated or failed authentication flows to disrupt access attempts, evade detection, or force fallback authentication behaviors. The detection relies on Azure sign-in log telemetry from sign-in logs capturing the ResultType/ResultDescription for each authentication attempt.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_unusual_authentication_interruption.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-26
modified: 2022-12-18
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078
logsource:
  product: azure
  service: signinlogs
detection:
  selection_50097:
    ResultType: 50097
    ResultDescription: Device authentication is required
  selection_50155:
    ResultType: 50155
    ResultDescription: DeviceAuthenticationFailed
  selection_50158:
    ResultType: 50158
    ResultDescription: ExternalSecurityChallenge - External security challenge was not satisfied
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 8366030e-7216-476b-9927-271d79f13cf3
    type: derived