Skip to content

Commit a50dedf

Browse files
terrancedejesusbryans3c
terrancedejesus
and
bryans3c
authored
[New Rule] Entra ID / M365 - Unusual ROPC Auth and/or Legacy Clients (#6377)
* [New Rule] Entra ID / M365 - Unusual ROPC Auth and/or Legacy Clients * Update rules/integrations/azure/initial_access_entra_id_unusual_legacy_auth_client_signin.toml Co-authored-by: Bryan Porras <bryan.porras@elastic.co> --------- Co-authored-by: Bryan Porras <bryan.porras@elastic.co>
1 parent 9aea98f commit a50dedf

3 files changed

Lines changed: 266 additions & 2 deletions

‎rules/integrations/azure/initial_access_entra_id_unusual_legacy_auth_client_signin.toml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
[metadata]
2+
creation_date = "2026/07/02"
3+
integration = ["azure"]
4+
maturity = "production"
5+
updated_date = "2026/07/02"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Detects a successful sign-in by a Member user principal through a legacy authentication client (such as Authenticated
11+
SMTP, IMAP4, POP3, Exchange ActiveSync, Exchange Web Services, or other basic-authentication clients) in Microsoft Entra
12+
ID, where the user principal has not been seen using a legacy client in the last 7 days. Legacy authentication clients
13+
rely on basic authentication, do not support modern authentication or interactive multi-factor authentication, and are
14+
frequently abused by adversaries for password spraying and account takeover because they translate into single-factor
15+
Resource Owner Password Credentials (ROPC) grants. This is a New Terms rule that surfaces the first occurrence of legacy
16+
client authentication for a given user, which is unusual in most modern environments.
17+
"""
18+
from = "now-9m"
19+
index = ["logs-azure.signinlogs-*"]
20+
language = "kuery"
21+
license = "Elastic License v2"
22+
name = "Entra ID User Sign-In via Unusual Legacy Authentication Client"
23+
note = """## Triage and analysis
24+
25+
### Investigating Entra ID User Sign-In via Unusual Legacy Authentication Client
26+
27+
Legacy authentication clients use basic authentication and do not support modern authentication or interactive multi-factor authentication. Microsoft Entra ID classifies these clients under `client_app_used` values such as Authenticated SMTP, IMAP4, POP3, Exchange ActiveSync, Exchange Web Services, MAPI Over HTTP, Outlook Anywhere, and Other clients (as opposed to the modern values Browser and Mobile Apps and Desktop clients). Adversaries prefer these clients because they translate into single-factor ROPC grants that bypass interactive MFA, making them effective for password spraying and account takeover.
28+
29+
This rule is a New Terms detection that fires when a Member user principal is first seen authenticating with a legacy client in the last 7 days. In environments that have largely moved to modern authentication, a new legacy-client sign-in for a user is unusual and warrants review. It is a broader companion to the targeted ROPC detections and catches legacy protocols beyond Authenticated SMTP.
30+
31+
### Possible investigation steps
32+
- Review `azure.signinlogs.properties.client_app_used` to identify which legacy protocol was used and whether the user is expected to use it.
33+
- Review `azure.signinlogs.properties.user_principal_name` to determine whether the account is a human user, a service account, or a shared mailbox, and whether legacy authentication is part of its normal behavior.
34+
- Review `azure.signinlogs.properties.client_ip` / `source.ip`, geolocation, and ASN to determine whether the source is expected. Correlate with known-malicious infrastructure.
35+
- Inspect `user_agent.original`. Values such as `BAV2ROPC`, `python-requests`, `curl`, or other scripting-tool agents are highly suspicious.
36+
- Check `azure.signinlogs.properties.applied_conditional_access_policies` to determine whether legacy-authentication blocking was expected to apply and why it did not.
37+
- Look for a preceding burst of failed authentications (password spraying) from the same source or against the same account, and for post-authentication actions such as mailbox rule creation, mail forwarding, or OAuth consent.
38+
39+
### False positive analysis
40+
- Legitimate legacy applications, service accounts, multifunction printers, scan-to-email appliances, and monitoring tools may still use legacy authentication clients such as Authenticated SMTP. These are typically stable in source IP and account and can be excluded once verified.
41+
- Migrations, onboarding of older mail clients, or line-of-business applications that have not yet moved to modern authentication can generate first-occurrence sign-ins. Validate the business context and exclude confirmed benign accounts.
42+
43+
### Response and remediation
44+
- If the sign-in is confirmed malicious, disable the account, revoke active sessions and refresh tokens, and reset the password.
45+
- Disable the specific legacy protocol for the affected mailbox (for example `Set-CASMailbox -SmtpClientAuthenticationDisabled $true`) and, where feasible, block legacy authentication tenant-wide with Conditional Access.
46+
- Enforce MFA for the affected user and investigate the source IP and any preceding failed-authentication activity to scope a potential password-spray campaign.
47+
- Review the account's activity after the sign-in (mailbox rules, forwarding, delegate changes, OAuth grants) and remediate any unauthorized changes.
48+
"""
49+
references = [
50+
"https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-legacy-authentication",
51+
"https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth-ropc",
52+
"https://www.proofpoint.com/us/blog/threat-insight/attackers-unleash-teamfiltration-account-takeover-campaign",
53+
"https://redcanary.com/blog/threat-detection/bav2ropc/",
54+
]
55+
risk_score = 47
56+
rule_id = "0b7dbb27-29f8-4219-bcf1-7b82c6dd0bdc"
57+
severity = "medium"
58+
tags = [
59+
"Domain: Cloud",
60+
"Domain: Identity",
61+
"Data Source: Azure",
62+
"Data Source: Microsoft Entra ID",
63+
"Data Source: Microsoft Entra ID Sign-In Logs",
64+
"Use Case: Identity and Access Audit",
65+
"Tactic: Initial Access",
66+
"Tactic: Defense Evasion",
67+
"Resources: Investigation Guide",
68+
]
69+
timestamp_override = "event.ingested"
70+
type = "new_terms"
71+
72+
query = '''
73+
data_stream.dataset: "azure.signinlogs" and
74+
event.action: "Sign-in activity" and
75+
event.outcome: "success" and
76+
azure.signinlogs.properties.user_type: "Member" and
77+
azure.signinlogs.properties.client_app_used: (
78+
"Authenticated SMTP" or
79+
"Autodiscover" or
80+
"Exchange ActiveSync" or
81+
"Exchange Online PowerShell" or
82+
"Exchange Web Services" or
83+
"IMAP4" or
84+
"MAPI Over HTTP" or
85+
"Offline Address Book" or
86+
"Outlook Anywhere" or
87+
"Outlook Service" or
88+
"POP3" or
89+
"Reporting Web Services" or
90+
"Other clients"
91+
)
92+
'''
93+
94+
95+
[[rule.threat]]
96+
framework = "MITRE ATT&CK"
97+
[[rule.threat.technique]]
98+
id = "T1078"
99+
name = "Valid Accounts"
100+
reference = "https://attack.mitre.org/techniques/T1078/"
101+
[[rule.threat.technique.subtechnique]]
102+
id = "T1078.004"
103+
name = "Cloud Accounts"
104+
reference = "https://attack.mitre.org/techniques/T1078/004/"
105+
106+
107+
108+
[rule.threat.tactic]
109+
id = "TA0001"
110+
name = "Initial Access"
111+
reference = "https://attack.mitre.org/tactics/TA0001/"
112+
[[rule.threat]]
113+
framework = "MITRE ATT&CK"
114+
[[rule.threat.technique]]
115+
id = "T1078"
116+
name = "Valid Accounts"
117+
reference = "https://attack.mitre.org/techniques/T1078/"
118+
[[rule.threat.technique.subtechnique]]
119+
id = "T1078.004"
120+
name = "Cloud Accounts"
121+
reference = "https://attack.mitre.org/techniques/T1078/004/"
122+
123+
124+
125+
[rule.threat.tactic]
126+
id = "TA0005"
127+
name = "Defense Evasion"
128+
reference = "https://attack.mitre.org/tactics/TA0005/"
129+
130+
[rule.new_terms]
131+
field = "new_terms_fields"
132+
value = ["azure.signinlogs.properties.user_principal_name"]
133+
[[rule.new_terms.history_window_start]]
134+
field = "history_window_start"
135+
value = "now-7d"
136+
137+

‎rules/integrations/azure/initial_access_entra_id_unusual_ropc_login_attempt.toml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
creation_date = "2025/07/02"
33
integration = ["azure"]
44
maturity = "production"
5-
updated_date = "2026/04/10"
5+
updated_date = "2026/07/02"
66

77
[rule]
88
author = ["Elastic"]
@@ -52,6 +52,8 @@ references = [
5252
"https://www.proofpoint.com/us/blog/threat-insight/attackers-unleash-teamfiltration-account-takeover-campaign",
5353
"https://dirkjanm.io/assets/raw/Finding%20Entra%20ID%20CA%20Bypasses%20-%20the%20structured%20way.pdf",
5454
"https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth-ropc",
55+
"https://redcanary.com/blog/threat-detection/bav2ropc/",
56+
"https://www.huntress.com/blog/lshiy-password-spray-attack"
5557
]
5658
risk_score = 47
5759
rule_id = "8d696bd0-5756-11f0-8e3b-f661ea17fbcd"
@@ -71,7 +73,10 @@ type = "new_terms"
7173

7274
query = '''
7375
data_stream.dataset: "azure.signinlogs" and
74-
azure.signinlogs.properties.authentication_protocol: "ropc" and
76+
(
77+
azure.signinlogs.properties.authentication_protocol: "ropc" or
78+
user_agent.original: "BAV2ROPC"
79+
) and
7580
azure.signinlogs.properties.authentication_requirement: "singleFactorAuthentication" and
7681
azure.signinlogs.properties.user_type: "Member" and
7782
event.outcome: "success"

‎rules/integrations/o365/initial_access_identity_ropc_grant_via_legacy_authenticated_client.toml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
[metadata]
2+
creation_date = "2026/07/02"
3+
integration = ["o365"]
4+
maturity = "production"
5+
updated_date = "2026/07/02"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies a successful login by a user principal through a legacy authenticated client (such as Authenticated SMTP,
11+
IMAP, POP, or Exchange ActiveSync) in the Microsoft 365 Unified Audit Log, evidenced by the "BAV2ROPC" user agent.
12+
Legacy basic-authentication clients are translated by Entra ID into a Resource Owner Password Credentials (ROPC) grant,
13+
a single-factor flow that submits the user's password directly and bypasses interactive multi-factor authentication.
14+
This is commonly abused during password spraying and account takeover.
15+
"""
16+
from = "now-9m"
17+
index = ["filebeat-*", "logs-o365.audit-*"]
18+
language = "kuery"
19+
license = "Elastic License v2"
20+
name = "M365 Identity OAuth ROPC Grant via Legacy Authentication Client"
21+
note = """## Triage and analysis
22+
23+
### Investigating M365 Identity OAuth ROPC Grant via Legacy Authentication Client
24+
25+
The Resource Owner Password Credentials (ROPC) flow allows a client to obtain tokens by submitting a user's credentials directly, without interactive sign-in. Legacy authentication clients (Authenticated SMTP, IMAP, POP, Exchange ActiveSync) that use basic authentication are translated by Entra ID into ROPC grants, which are single-factor and bypass interactive MFA. Microsoft 365 records these logins in the Unified Audit Log as `UserLoggedIn` events with the `BAV2ROPC` user agent. Adversaries abuse this flow for password spraying and account takeover against accounts that lack MFA enforcement or fall outside legacy-authentication blocking.
26+
27+
This rule identifies a successful ROPC/legacy-client login for a user principal not seen performing this activity in the last 10 days. Because the Unified Audit Log is a separate pipeline from the Entra ID sign-in diagnostic stream, this rule provides coverage even when non-interactive sign-in logs are not forwarded to the SIEM.
28+
29+
### Possible investigation steps
30+
- Review `o365.audit.UserId` to identify the account that authenticated and determine whether it is expected to use legacy authentication clients.
31+
- Review `o365.audit.ApplicationId` and `o365.audit.Target.ID` to identify the targeted resource. `00000002-0000-0ff1-ce00-000000000000` is Office 365 Exchange Online, the typical target of Authenticated SMTP.
32+
- Confirm the client via `user_agent.original: "BAV2ROPC"`, which indicates a legacy basic-authentication client translated into a ROPC grant.
33+
- Review `o365.audit.ClientIP` / `source.ip` and geolocation to determine whether the source is expected for this user. Correlate with known-malicious infrastructure or unusual ASNs.
34+
- Pivot on `o365.audit.UserId` in Entra ID Sign-In Logs (`logs-azure.signinlogs-*`) to corroborate the login, and look for a preceding burst of failed authentications (password spraying) from the same source or against the same account.
35+
- Review subsequent activity by the account (mailbox access, rule creation, mail forwarding, OAuth consent) for signs of post-compromise actions on objectives.
36+
37+
### False positive analysis
38+
- Legitimate legacy applications, service accounts, or scripts that still rely on Authenticated SMTP or other basic-authentication clients may trigger this rule. Validate the account, source, and business purpose, and exclude confirmed benign service accounts.
39+
- Multifunction devices, scan-to-email appliances, and monitoring tools that submit mail via Authenticated SMTP can generate this activity. These are typically stable in source IP and account and can be excluded once verified.
40+
41+
### Response and remediation
42+
- If the login is confirmed malicious, disable the account, revoke active sessions and refresh tokens, and reset the password.
43+
- Disable SMTP AUTH and other legacy authentication for the affected mailbox (`Set-CASMailbox -SmtpClientAuthenticationDisabled $true`) and, where feasible, tenant-wide.
44+
- Enforce a Conditional Access policy that requires MFA and blocks legacy authentication for the affected user and, ideally, all users.
45+
- Investigate the source IP and any preceding failed-authentication activity to scope a potential password-spray campaign.
46+
- Review the account's activity after the login (mailbox rules, forwarding, delegate changes, OAuth grants) and remediate any unauthorized changes.
47+
"""
48+
references = [
49+
"https://www.proofpoint.com/us/blog/threat-insight/attackers-unleash-teamfiltration-account-takeover-campaign",
50+
"https://redcanary.com/blog/threat-detection/bav2ropc/",
51+
"https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth-ropc",
52+
"https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema",
53+
"https://www.huntress.com/blog/lshiy-password-spray-attack",
54+
]
55+
risk_score = 47
56+
rule_id = "3d753eb2-68c4-404a-9279-91a3ad490765"
57+
severity = "medium"
58+
tags = [
59+
"Domain: Cloud",
60+
"Domain: Identity",
61+
"Data Source: Microsoft 365",
62+
"Data Source: Microsoft 365 Audit Logs",
63+
"Use Case: Identity and Access Audit",
64+
"Tactic: Initial Access",
65+
"Tactic: Defense Evasion",
66+
"Resources: Investigation Guide",
67+
]
68+
timestamp_override = "event.ingested"
69+
type = "new_terms"
70+
71+
query = '''
72+
data_stream.dataset: "o365.audit" and
73+
event.code: "AzureActiveDirectoryStsLogon" and
74+
event.action: "UserLoggedIn" and
75+
user_agent.original: "BAV2ROPC" and
76+
event.outcome: "success"
77+
'''
78+
79+
80+
[[rule.threat]]
81+
framework = "MITRE ATT&CK"
82+
[[rule.threat.technique]]
83+
id = "T1078"
84+
name = "Valid Accounts"
85+
reference = "https://attack.mitre.org/techniques/T1078/"
86+
[[rule.threat.technique.subtechnique]]
87+
id = "T1078.004"
88+
name = "Cloud Accounts"
89+
reference = "https://attack.mitre.org/techniques/T1078/004/"
90+
91+
92+
93+
[rule.threat.tactic]
94+
id = "TA0001"
95+
name = "Initial Access"
96+
reference = "https://attack.mitre.org/tactics/TA0001/"
97+
[[rule.threat]]
98+
framework = "MITRE ATT&CK"
99+
[[rule.threat.technique]]
100+
id = "T1078"
101+
name = "Valid Accounts"
102+
reference = "https://attack.mitre.org/techniques/T1078/"
103+
[[rule.threat.technique.subtechnique]]
104+
id = "T1078.004"
105+
name = "Cloud Accounts"
106+
reference = "https://attack.mitre.org/techniques/T1078/004/"
107+
108+
109+
110+
[rule.threat.tactic]
111+
id = "TA0005"
112+
name = "Defense Evasion"
113+
reference = "https://attack.mitre.org/tactics/TA0005/"
114+
115+
[rule.new_terms]
116+
field = "new_terms_fields"
117+
value = ["o365.audit.UserId"]
118+
[[rule.new_terms.history_window_start]]
119+
field = "history_window_start"
120+
value = "now-7d"
121+
122+

0 commit comments

Comments
 (0)