Azure Sign-In Risky Success From Non-Registered Device Without MFA Requirement

title: Azure Sign-In Risky Success From Non-Registered Device Without MFA Requirement
id: b735f714-e4df-4f3b-943c-6c1b935ab39c
status: test
description: This rule flags successful sign-ins where risk is marked as atRisk, MFA is not required (single-factor authentication), and the device trust type is empty or null (non-registered device indicator). Attackers may use unverified or non-compliant devices to blend in while avoiding stronger authentication controls. The detection relies on Azure sign-in log fields including sign-in status, authentication requirement, risk state, and device trust type.
references:
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml
author: Harjot Singh, '@cyb3rjy0t', Huntrule Team
date: 2023-01-10
modified: 2025-07-02
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078
logsource:
  product: azure
  service: signinlogs
detection:
  selection_main:
    Status: Success
    AuthenticationRequirement: singleFactorAuthentication
    RiskState: atRisk
  selection_empty1:
    DeviceDetail.trusttype: ""
  selection_empty2:
    DeviceDetail.trusttype: null
  condition: selection_main and 1 of selection_empty*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 572b12d4-9062-11ed-a1eb-0242ac120002
    type: derived