Azure Sign-In: Successful single-factor atRisk logins from non-registered devices
Alerts on at-risk successful Azure sign-ins from devices with missing trust type when MFA isn’t required.
- Product
- azure
- Service
- signinlogs
- Author
- Harjot Singh, '@cyb3rjy0t' (SigmaHQ), DRL 1.1
- Published
- 2023-01-10
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies successful Azure sign-ins marked as atRisk where only single-factor authentication was used and the sign-in device trust type is empty or null. Attackers may use low-assurance device states to blend into normal activity while maintaining access without triggering stronger MFA requirements. Detection relies on Azure sign-in log telemetry fields including authentication requirement, risk state, sign-in status, and device detail trust type.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Sign-In: Successful single-factor atRisk logins from non-registered devices"
id: b735f714-e4df-4f3b-943c-6c1b935ab39c
status: test
description: This rule identifies successful Azure sign-ins marked as atRisk where only single-factor authentication was used and the sign-in device trust type is empty or null. Attackers may use low-assurance device states to blend into normal activity while maintaining access without triggering stronger MFA requirements. Detection relies on Azure sign-in log telemetry fields including authentication requirement, risk state, sign-in status, and device detail trust type.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/signin_logs/azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml
author: Harjot Singh, '@cyb3rjy0t', Huntrule Team
date: 2023-01-10
modified: 2025-07-02
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.stealth
- attack.t1078
logsource:
product: azure
service: signinlogs
detection:
selection_main:
Status: Success
AuthenticationRequirement: singleFactorAuthentication
RiskState: atRisk
selection_empty1:
DeviceDetail.trusttype: ""
selection_empty2:
DeviceDetail.trusttype: null
condition: selection_main and 1 of selection_empty*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 572b12d4-9062-11ed-a1eb-0242ac120002
type: derived