Azure Sign-In Logs: Detect ROPC Authentication Flow Use in Applications

Flags Azure AD sign-ins where the message indicates an application is using the ROPC authentication flow.

FreeUnreviewedSigmamediumv1

azure-sign-in-logs-detect-ropc-authentication-flow-use-in-applications-55695bc0

title: "Azure Sign-In Logs: Detect ROPC Authentication Flow Use in Applications"
id: a9b97c75-ec51-4147-8820-116b845109b0
status: test
description: This rule flags Azure AD sign-in events whose message contains the string "ROPC", indicating an application is using the Resource Owner Password Credentials (ROPC) authentication flow. Attackers may prefer ROPC because it directly prompts the user to expose current password credentials to the application before authentication against the identity provider. The detection relies on Azure sign-in log telemetry, specifically the message field in sign-in logs containing "ROPC".
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_app_ropc_authentication.yml
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', Huntrule Team
date: 2022-06-01
tags:
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    properties.message: ROPC
  condition: selection
falsepositives:
  - Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow
level: medium
license: DRL-1.1
related:
  - id: 55695bc0-c8cf-461f-a379-2535f563c854
    type: derived

What it detects

This rule flags Azure AD sign-in events whose message contains the string "ROPC", indicating an application is using the Resource Owner Password Credentials (ROPC) authentication flow. Attackers may prefer ROPC because it directly prompts the user to expose current password credentials to the application before authentication against the identity provider. The detection relies on Azure sign-in log telemetry, specifically the message field in sign-in logs containing "ROPC".

Known false positives

Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.