Suspicious Applications That Are Via ROPC Authentication Flow (via signinlogs)

title: Suspicious Applications That Are Via ROPC Authentication Flow (via signinlogs)
id: 69b6df3e-464c-5f00-a64b-2051647d1626
status: stable
description: This rule detects resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.
references:
    - https://attack.mitre.org/techniques/T1078/
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows
author: Huntrule Team
date: 2026-05-26
tags:
    - attack.stealth
    - attack.t1078
    - attack.persistence
    - attack.privilege-escalation
    - attack.initial-access
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        properties.message: ROPC
    condition: selection
falsepositives:
    - Unknown
level: medium