Detection rules › By catalog entry

Entra-AADServicePrincipalSignInLogs

Catalog entry	Rules
any	58
Success	2
Target application	1
Conditional Access status	1

any

58 detection rules reference this catalog entry. View catalog entry.

Elastic (35)

Entra ID Concurrent Sign-in with Suspicious Properties severity high T1078,T1078.004,T1528,T1550,T1550.001,T1566
Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN severity medium T1078,T1078.004,T1556,T1556.009
Entra ID Device-Bound PRT from Unusual Device IP severity high T1078,T1078.004,T1528,T1539,T1550,T1550.001
Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP severity high T1078,T1078.004,T1528,T1539,T1550,T1550.001
Entra ID Deviceless Windows Hello Sign-in Followed by Device Registration severity high T1098,T1098.005,T1550
Entra ID High Risk Sign-in severity high T1078,T1078.004
Entra ID High Risk User Sign-in Heuristic severity medium T1078,T1078.004
Entra ID Kali365 Default User-Agent Detected severity high T1078,T1078.004,T1528,T1550,T1550.001,T1566
Entra ID MFA TOTP Brute Force Attempted severity medium T1110,T1110.001
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN severity high T1098,T1098.005,T1550,T1550.001,T1566,T1566.002
Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource severity high T1078,T1078.004,T1550,T1550.001
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent severity high T1078,T1078.004,T1539,T1566,T1566.002
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource severity medium T1078,T1078.004,T1199,T1528,T1550,T1550.001
Entra ID OAuth Device Code Flow with Concurrent Sign-ins severity high T1078,T1078.004,T1528,T1566,T1566.002
Entra ID OAuth Device Code Grant by Microsoft Authentication Broker severity medium T1078,T1078.004,T1550,T1550.001,T1566,T1566.002
Entra ID OAuth Device Code Grant by Unusual User severity medium T1078,T1078.004,T1550,T1550.001,T1566,T1566.002
Entra ID OAuth Device Code Phishing via AiTM severity high T1078,T1078.004,T1550,T1550.001,T1566,T1566.002
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration severity high T1069,T1069.003,T1078,T1078.004,T1087,T1087.004
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) severity high T1078,T1078.004,T1528,T1550,T1550.001,T1566
Entra ID OAuth Phishing via First-Party Microsoft Application severity medium T1078,T1078.004,T1199,T1528,T1550,T1550.001
Entra ID OAuth ROPC Grant Login Detected severity medium T1078,T1078.004
Entra ID OAuth User Impersonation to Microsoft Graph severity medium T1078,T1078.004,T1550,T1550.001,T1550.004
Entra ID OAuth user_impersonation Scope for Unusual User and Client severity medium T1078,T1078.004,T1550,T1550.001,T1684.001
Entra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA) severity high T1539,T1566
Entra ID PowerShell Sign-in severity low T1059,T1059.001,T1078,T1078.004
Entra ID ROPC Authentication with Unknown Client ID severity medium T1087,T1087.004,T1110,T1110.003
Entra ID Sharepoint or OneDrive Accessed by Unusual Client severity medium T1078,T1078.004,T1098,T1098.001,T1213,T1213.002
Entra ID Sign-in BloodHound Suite User-Agent Detected severity high T1069,T1069.003,T1082,T1087,T1087.004,T1201
Entra ID Sign-in TeamFiltration User-Agent Detected severity high T1069,T1069.003,T1082,T1087,T1087.004,T1110
Entra ID User Sign-In via Unusual Legacy Authentication Client severity medium T1078,T1078.004
Entra ID User Sign-in with Unusual Authentication Type severity medium T1078,T1078.004,T1550,T1556,T1556.006
Entra ID User Sign-in with Unusual Client severity medium T1078,T1078.004,T1528,T1550,T1550.001
Entra ID User Sign-in with Unusual Non-Managed Device severity low T1078,T1078.004,T1098,T1098.005
Entra ID Windows Hello or Passkey Sign-in from Unregistered Device severity medium T1078,T1078.004,T1550
M365 or Entra ID Identity Sign-in from a Suspicious Source severity high T1078

Splunk (4)

Azure AD Multi-Source Failed Authentications Spike T1110,T1110.003,T1110.004,T1586,T1586.003
Azure AD Service Principal Authentication severity medium T1078,T1078.004
Azure AD User Consent Denied for OAuth Application severity medium T1528
Detect Distributed Password Spray Attempts T1110,T1110.003

Kusto (3)

Lumen TI IPAddress in IdentityLogonEvents severity medium T1071
Service Principal Authentication Attempt from New Country severity medium T1078,T1078.004
Suspicious Service Principal creation activity severity low T1078,T1528

YARA-L (5)

Entra ID Admin Login Activity to Uncommon MS Cloud Apps severity medium T1078,T1078.004
Entra ID Login Activity to Azure AD PowerShell Application severity medium
Entra ID Login Activity to Uncommon MS Cloud Apps severity low T1078,T1078.004
GeoIP User Login From Multiple States Or Countries severity low
Microsoft Entra ID Device code phishing attack severity high T1566

Panther (11)

Azure Device Code Authentication with Broker Client severity medium T1078,T1078.004,T1550,T1550.001,T1566,T1566.002
Azure Excessive Account Lockouts severity high T1110,T1110.001,T1110.003,T1110.004
Azure High-Risk Sign-In severity high T1078
Azure Many Failed SignIns severity medium T1078,T1110
Azure Microsoft Graph Single Session from Multiple IP Addresses severity medium T1078,T1078.004,T1550,T1550.001
Azure Protection Multiple Alerts for User severity high T1078,T1078.004
Azure RiskLevel Passthrough severity medium T1078,T1110
Azure ROPC Login Attempt Without MFA severity medium T1078,T1078.004
Azure SignIn via Legacy Authentication Protocol severity medium
Azure VS Code OAuth Phishing severity medium T1528,T1566
Sign In from Rogue State severity medium T1078.004

Success

2 detection rules reference this catalog entry. View catalog entry.

Elastic (2)

Azure Service Principal Sign-In Followed by Arc Cluster Credential Access severity medium T1078,T1078.004,T1528,T1552,T1552.007
Entra ID Service Principal with Unusual Source ASN severity medium T1078,T1078.004

Target application

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

Entra ID Service Principal Federated Credential Authentication by Unusual Client severity high T1078,T1078.004,T1098,T1098.001,T1550,T1550.001

Conditional Access status

1 detection rules reference this catalog entry. View catalog entry.

Kusto (1)

Secret Exposure with Anomalous SPN Sign-In severity high T1078,T1078.004,T1552

Back to all Entra-AADServicePrincipalSignInLogs catalog entries