Detection rules › By event

Entra-AADNonInteractiveUserSignInLogs

Event	Rules
any	85
Success	7
Invalid-credentials	2
Account-locked	1
Password-expired	2
Disabled	2
MFA-challenged	3
Other	2
Target application	7
Authentication requirement	2

any

85 detection rules reference this event. View event page.

Elastic (31)

Entra ID Concurrent Sign-in with Suspicious Properties severity high T1078, T1078.004, T1528, T1550, T1550.001, T1566
Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN severity medium T1078, T1078.004, T1556, T1556.009
Entra ID High Risk Sign-in severity high T1078, T1078.004
Entra ID High Risk User Sign-in Heuristic severity medium T1078, T1078.004
Entra ID Kali365 Default User-Agent Detected severity high T1078, T1078.004, T1528, T1550, T1550.001, T1566
Entra ID MFA TOTP Brute Force Attempted severity medium T1110, T1110.001
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN severity high T1098, T1098.005, T1550, T1550.001, T1566, T1566.002
Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource severity high T1078, T1078.004, T1550, T1550.001
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent severity high T1078, T1078.004, T1539, T1566, T1566.002
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource severity medium T1078, T1078.004, T1199, T1528, T1550, T1550.001
Entra ID OAuth Device Code Flow with Concurrent Sign-ins severity high T1078, T1078.004, T1528, T1566, T1566.002
Entra ID OAuth Device Code Grant by Microsoft Authentication Broker severity medium T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Entra ID OAuth Device Code Grant by Unusual User severity medium T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Entra ID OAuth Device Code Phishing via AiTM severity high T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration severity high T1069, T1069.003, T1078, T1078.004, T1087, T1087.004
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) severity high T1078, T1078.004, T1528, T1550, T1550.001, T1566
Entra ID OAuth Phishing via First-Party Microsoft Application severity medium T1078, T1078.004, T1199, T1528, T1550, T1550.001
Entra ID OAuth ROPC Grant Login Detected severity medium T1078, T1078.004
Entra ID OAuth User Impersonation to Microsoft Graph severity medium T1078, T1078.004, T1550, T1550.001, T1550.004
Entra ID OAuth user_impersonation Scope for Unusual User and Client severity medium T1078, T1078.004, T1550, T1550.001, T1684.001
Entra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA) severity high T1539, T1566
Entra ID PowerShell Sign-in severity low T1059, T1059.001, T1078, T1078.004
Entra ID ROPC Authentication with Unknown Client ID severity medium T1087, T1087.004, T1110, T1110.003
Entra ID Sharepoint or OneDrive Accessed by Unusual Client severity medium T1078, T1078.004, T1098, T1098.001, T1213, T1213.002
Entra ID Sign-in BloodHound Suite User-Agent Detected severity high T1069, T1069.003, T1082, T1087, T1087.004, T1201
Entra ID Sign-in TeamFiltration User-Agent Detected severity high T1069, T1069.003, T1082, T1087, T1087.004, T1110
Entra ID User Sign-In via Unusual Legacy Authentication Client severity medium T1078, T1078.004
Entra ID User Sign-in with Unusual Authentication Type severity medium T1078, T1078.004, T1110, T1110.003, T1550, T1556
Entra ID User Sign-in with Unusual Client severity medium T1078, T1078.004, T1528, T1550, T1550.001
Entra ID User Sign-in with Unusual Non-Managed Device severity low T1078, T1078.004, T1098, T1098.005
M365 or Entra ID Identity Sign-in from a Suspicious Source severity high T1078

Splunk (4)

Azure AD AzureHound UserAgent Detected severity medium T1087, T1087.004, T1526
Azure AD Multi-Source Failed Authentications Spike T1110, T1110.003, T1110.004, T1586, T1586.003
Azure AD User Consent Denied for OAuth Application severity medium T1528
Detect Distributed Password Spray Attempts T1110, T1110.003

Kusto (33)

[Deprecated] Explicit MFA Deny severity medium T1110
Anomalous login followed by Teams action severity medium T1078, T1098, T1136, T1199
Attempt to bypass conditional access rule in Microsoft Entra ID severity low T1078, T1098
Attempts to sign in to disabled accounts severity medium T1078
Authentication Attempt from New Country severity medium T1078, T1078.004
Brute force attack against Azure Portal severity medium T1110
Brute Force Attack against GitHub Account severity medium T1110
Detect device code login with user risk T1078, T1078.004
Distributed Password cracking attempts in Microsoft Entra ID severity medium T1110
Failed AzureAD logons but success logon to AWS Console severity medium T1078, T1110
Failed AzureAD logons but success logon to host severity medium T1078, T1110
Failed host logons but success logon to AzureAD severity medium T1078, T1110
Failed login attempts to Azure Portal severity low T1110
GitHub Signin Burst from Multiple Locations severity medium T1110
GreyNoise TI Map IP Entity to SigninLogs severity medium T1071
HoneyLabs TI Map IP Entity to SigninLogs severity medium T1110, T1190
IP with multiple failed Microsoft Entra ID logins successfully logs in to Palo Alto VPN severity medium T1078, T1110
Log4j vulnerability exploit aka Log4Shell IP IOC severity high T1071
Lumen TI IPAddress in IdentityLogonEvents severity medium T1071
Malformed user agent severity medium T1071, T1189, T1203
Microsoft Entra ID PowerShell accessing non-Entra ID resources severity low T1078
Password spray attack against Microsoft Entra ID application severity medium T1110
Password spray attack against Microsoft Entra ID Seamless SSO severity medium T1110
Privileged Accounts - Sign in Failure Spikes severity high T1078, T1078.004
Sign-ins from IPs that attempt sign-ins to disabled accounts severity medium T1078, T1098
Successful logon from IP and failure from a different IP severity medium T1078, T1110
ThreatConnect TI map Email entity to SigninLogs severity medium T1071
TI Map Email entity to SigninLogs severity medium T1566
TI map Email entity to SigninLogs severity medium T1566
TI Map IP Entity to SigninLogs severity medium T1071
TI Map IP Entity to SigninLogs severity medium T1071
User Accounts - Sign in Failure due to CA Spikes severity medium T1078, T1078.004
User agent search for log4j exploitation attempt severity high T1190

YARA-L (5)

Entra ID Admin Login Activity to Uncommon MS Cloud Apps severity medium T1078, T1078.004
Entra ID Login Activity to Azure AD PowerShell Application severity medium
Entra ID Login Activity to Uncommon MS Cloud Apps severity low T1078, T1078.004
GeoIP User Login From Multiple States Or Countries severity low
Microsoft Entra ID Device code phishing attack severity high T1566

Panther (12)

Azure Device Code Authentication with Broker Client severity medium T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Azure Excessive Account Lockouts severity high T1110, T1110.001, T1110.003, T1110.004
Azure High-Risk Sign-In severity high T1078
Azure Many Failed SignIns severity medium T1078, T1110
Azure Microsoft Graph Single Session from Multiple IP Addresses severity medium T1078, T1078.004, T1550, T1550.001
Azure Protection Multiple Alerts for User severity high T1078, T1078.004
Azure RiskLevel Passthrough severity medium T1078, T1110
Azure ROPC Login Attempt Without MFA severity medium T1078, T1078.004
Azure SignIn via Legacy Authentication Protocol severity medium
Azure VS Code OAuth Phishing severity medium T1528, T1566
Microsoft Entra ID First Time Seen Device Code Authentication
Sign In from Rogue State severity medium T1078.004

Success

7 detection rules reference this event. View event page.

Elastic (1)

Entra ID AiTM Phishing-Kit Chain Detected severity high T1078, T1078.004, T1098, T1098.005, T1528, T1550

Splunk (1)

Azure AD Concurrent Sessions From Different Ips severity medium T1185

Kusto (5)

[Entra ID] Suspicious Continuous OAuth Token Usage severity high T1606
Anomalous sign-in location by user account and authenticating application severity medium T1078
Cisco - firewall block but success logon to Microsoft Entra ID severity medium T1078
Microsoft Entra ID Rare UserAgent App Sign-in severity medium T1036
Microsoft Entra ID UserAgent OS Missmatch severity medium T1036

Invalid-credentials

2 detection rules reference this event. View event page.

Elastic (2)

Entra ID Sign-in Brute Force Attempted (Microsoft 365) severity medium T1110, T1110.001, T1110.003, T1110.004
Entra ID User Sign-in Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

Account-locked

1 detection rules reference this event. View event page.

Elastic (1)

Entra ID Excessive Account Lockouts Detected severity high T1110, T1110.001, T1110.003, T1110.004

Password-expired

2 detection rules reference this event. View event page.

Elastic (2)

Entra ID Sign-in Brute Force Attempted (Microsoft 365) severity medium T1110, T1110.001, T1110.003, T1110.004
Entra ID User Sign-in Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

Disabled

2 detection rules reference this event. View event page.

Elastic (2)

Entra ID Sign-in Brute Force Attempted (Microsoft 365) severity medium T1110, T1110.001, T1110.003, T1110.004
Entra ID User Sign-in Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

MFA-challenged

3 detection rules reference this event. View event page.

Elastic (2)

Entra ID Sign-in Brute Force Attempted (Microsoft 365) severity medium T1110, T1110.001, T1110.003, T1110.004
Entra ID User Sign-in Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

Kusto (1)

Cisco - firewall block but success logon to Microsoft Entra ID severity medium T1078

Other

2 detection rules reference this event. View event page.

Elastic (2)

Entra ID Sign-in Brute Force Attempted (Microsoft 365) severity medium T1110, T1110.001, T1110.003, T1110.004
Entra ID User Sign-in Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

Target application

7 detection rules reference this event. View event page.

Elastic (4)

Entra ID ADRS Token Request by Microsoft Authentication Broker severity medium T1098, T1098.005, T1550
Entra ID AiTM Phishing-Kit Chain Detected severity high T1078, T1078.004, T1098, T1098.005, T1528, T1550
Entra ID OAuth PRT Issuance to Non-Managed Device Detected severity medium T1078, T1078.004, T1098, T1098.005, T1528, T1550
Entra ID Sign-in Brute Force Attempted (Microsoft 365) severity medium T1110, T1110.001, T1110.003, T1110.004

Kusto (3)

Authentication requirement

2 detection rules reference this event. View event page.

Elastic (2)

Entra ID Excessive Account Lockouts Detected severity high T1110, T1110.001, T1110.003, T1110.004
Entra ID User Sign-in Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004