Detection rules › YARA-L
O365 Persistent Login Activity To Azure AD PowerShell App
Continual logins to Azure AD PowerShell app are not a security best practice, if this is observed, additional investigation is needed
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Microsoft 365 | UserLoggedIn |
Rules detecting the same action
These rules filter on the same operation.
- Azure Login Bypassing Conditional Access Policies (Sigma)
- Hunt for suspicious sign-in to Entra ID Using Extrnal Call Method (YARA-L)
- M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs (Elastic)
- M365 Identity OAuth Flow by User Sign-in to Device Registration (Elastic)
- M365 Identity OAuth Phishing via First-Party Microsoft Application (Elastic)
- M365 Identity OAuth ROPC Grant via Legacy Authentication Client (Elastic)
- M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA) (Elastic)
- O365 AD PowerShell App Login Subsequent Activity (YARA-L)
Rule body
// Copyright 2025 Google LLC. Licensed under Apache-2.0.
rule o365_persistent_login_activity_to_azure_ADPowerShell_app {
meta:
author = "Google Cloud Security"
description = "Continual logins to Azure AD PowerShell app are not a security best practice, if this is observed, additional investigation is needed"
rule_id = "mr_4e61ae7f-d9fc-4c2a-b086-69d9d50dc5cc"
rule_name = "O365 Persistent Login Activity To Azure AD PowerShell App"
tactic = "TA0008"
technique = "T1021.007"
type = "alert"
platform = "azure"
data_source = "o365"
severity = "Medium"
priority = "Medium"
events:
$login.metadata.event_type = "USER_LOGIN"
$login.metadata.product_event_type = "UserLoggedIn"
$login.metadata.product_name = "Office 365"
$login.metadata.vendor_name = "Microsoft"
$login.target.resource.product_object_id = "1b730954-1685-4b74-9bfd-dac224a7b894"
$login.security_result.action = "ALLOW"
$login.target.user.userid = $userid
$login.metadata.event_timestamp.seconds = $time
match:
$userid over 24h
outcome:
$risk_score = 65
$event_count = count_distinct($login.metadata.id)
$entra_id_login_threshold = 2
$security_summary = array_distinct($login.security_result.summary)
$user_agent = array_distinct($login.network.http.user_agent)
$country_region_login_attempt = array_distinct($login.principal.ip_geo_artifact.location.country_or_region)
//added to populate alert graph with additional context
$principal_ip = array_distinct($login.principal.ip)
$target_user_userid = array_distinct($login.target.user.userid)
condition:
// Can set based on your own threshold
#time > 1
}
YARA-L rule structure
Condition
Fires when $time occurs more than 1 times in the 24h window.
Events
$login
metadata.product_event_type = "UserLoggedIn"target.resource.product_object_id = "1b730954-1685-4b74-9bfd-dac224a7b894"security_result.action = "ALLOW"
Match and correlation
Outcome
Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.
| Field | Expression |
|---|---|
risk_score | 65 |
event_count | count_distinct($login.metadata.id) |
entra_id_login_threshold | 2 |
security_summary | array_distinct($login.security_result.summary) |
user_agent | array_distinct($login.network.http.user_agent) |
country_region_login_attempt | array_distinct($login.principal.ip_geo_artifact.location.country_or_region) |
principal_ip | array_distinct($login.principal.ip) |
target_user_userid | array_distinct($login.target.user.userid) |