Azure AD Sign-ins Using Legacy Authentication Client Applications

title: Azure AD Sign-ins Using Legacy Authentication Client Applications
id: f87c63b0-c10b-4455-9ea0-fed2c54afa77
status: test
description: This rule flags Azure AD sign-in events where authentication is attempted using legacy protocol client types (e.g., IMAP, POP3, MAPI, SMTP, Exchange ActiveSync, and Exchange Web Services). Attackers may use legacy authentication to gain or maintain access and to blend in with non-interactive or older client behaviors. The detection relies on Azure sign-in log telemetry including the sign-in activity type, client application classification, and the presence of a UPN in the event.
references:
  - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-privileged-accounts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_legacy_authentication_protocols.yml
author: Yochana Henderson, '@Yochana-H', Huntrule Team
date: 2022-06-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.credential-access
  - attack.stealth
  - attack.t1078.004
  - attack.t1110
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ActivityDetails: Sign-ins
    ClientApp:
      - Other client
      - IMAP
      - POP3
      - MAPI
      - SMTP
      - Exchange ActiveSync
      - Exchange Web Services
    Username: UPN
  condition: selection
falsepositives:
  - User has been put in acception group so they can use legacy authentication
level: high
license: DRL-1.1
related:
  - id: 60f6535a-760f-42a9-be3f-c9a0a025906e
    type: derived