Azure Sign-in Logs: Legacy Authentication Protocols Used by Account

title: "Azure Sign-in Logs: Legacy Authentication Protocols Used by Account"
id: f87c63b0-c10b-4455-9ea0-fed2c54afa77
status: test
description: This rule flags Azure sign-in events where the client application is one of several legacy authentication protocol types (e.g., IMAP, POP3, MAPI, SMTP, Exchange ActiveSync, Exchange Web Services, or Other) for a user (UPN). Attackers can use legacy protocols to blend in with expected traffic or maintain access via weaker authentication pathways, making these sign-ins important to investigate. Detection relies on Azure sign-in log telemetry, specifically the sign-in activity type, client application field, and the presence of a username (UPN).
references:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_legacy_authentication_protocols.yml
author: Yochana Henderson, '@Yochana-H', Huntrule Team
date: 2022-06-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.credential-access
  - attack.stealth
  - attack.t1078.004
  - attack.t1110
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ActivityDetails: Sign-ins
    ClientApp:
      - Other client
      - IMAP
      - POP3
      - MAPI
      - SMTP
      - Exchange ActiveSync
      - Exchange Web Services
    Username: UPN
  condition: selection
falsepositives:
  - User has been put in acception group so they can use legacy authentication
level: high
license: DRL-1.1
related:
  - id: 60f6535a-760f-42a9-be3f-c9a0a025906e
    type: derived