Detection rules › By event

Entra-SigninLogs

Event	Rules
any	95
Success	32
Invalid-credentials	6
Account-locked	2
Password-expired	2
Disabled	5
MFA-challenged	8
Blocked-by-CA	3
Other	6
Identity Protection (risk)	6
Target application	19
Authentication requirement	10
Conditional Access status	1
Client app (legacy authentication)	1

any

95 detection rules reference this event. View event page.

Sigma (4)

Application Using Device Code Authentication Flow severity medium T1078
Applications That Are Using ROPC Authentication Flow severity medium T1078
Azure Sign-In With Axios User Agent severity low T1557
Sign-ins from Non-Compliant Devices severity high T1078, T1078.004

Elastic (31)

Entra ID Concurrent Sign-in with Suspicious Properties severity high T1078, T1078.004, T1528, T1550, T1550.001, T1566
Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN severity medium T1078, T1078.004, T1556, T1556.009
Entra ID High Risk Sign-in severity high T1078, T1078.004
Entra ID High Risk User Sign-in Heuristic severity medium T1078, T1078.004
Entra ID Kali365 Default User-Agent Detected severity high T1078, T1078.004, T1528, T1550, T1550.001, T1566
Entra ID MFA TOTP Brute Force Attempted severity medium T1110, T1110.001
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN severity high T1098, T1098.005, T1550, T1550.001, T1566, T1566.002
Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource severity high T1078, T1078.004, T1550, T1550.001
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent severity high T1078, T1078.004, T1539, T1566, T1566.002
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource severity medium T1078, T1078.004, T1199, T1528, T1550, T1550.001
Entra ID OAuth Device Code Flow with Concurrent Sign-ins severity high T1078, T1078.004, T1528, T1566, T1566.002
Entra ID OAuth Device Code Grant by Microsoft Authentication Broker severity medium T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Entra ID OAuth Device Code Grant by Unusual User severity medium T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Entra ID OAuth Device Code Phishing via AiTM severity high T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration severity high T1069, T1069.003, T1078, T1078.004, T1087, T1087.004
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) severity high T1078, T1078.004, T1528, T1550, T1550.001, T1566
Entra ID OAuth Phishing via First-Party Microsoft Application severity medium T1078, T1078.004, T1199, T1528, T1550, T1550.001
Entra ID OAuth ROPC Grant Login Detected severity medium T1078, T1078.004
Entra ID OAuth User Impersonation to Microsoft Graph severity medium T1078, T1078.004, T1550, T1550.001, T1550.004
Entra ID OAuth user_impersonation Scope for Unusual User and Client severity medium T1078, T1078.004, T1550, T1550.001, T1684.001
Entra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA) severity high T1539, T1566
Entra ID PowerShell Sign-in severity low T1059, T1059.001, T1078, T1078.004
Entra ID ROPC Authentication with Unknown Client ID severity medium T1087, T1087.004, T1110, T1110.003
Entra ID Sharepoint or OneDrive Accessed by Unusual Client severity medium T1078, T1078.004, T1098, T1098.001, T1213, T1213.002
Entra ID Sign-in BloodHound Suite User-Agent Detected severity high T1069, T1069.003, T1082, T1087, T1087.004, T1201
Entra ID Sign-in TeamFiltration User-Agent Detected severity high T1069, T1069.003, T1082, T1087, T1087.004, T1110
Entra ID User Sign-In via Unusual Legacy Authentication Client severity medium T1078, T1078.004
Entra ID User Sign-in with Unusual Authentication Type severity medium T1078, T1078.004, T1110, T1110.003, T1550, T1556
Entra ID User Sign-in with Unusual Client severity medium T1078, T1078.004, T1528, T1550, T1550.001
Entra ID User Sign-in with Unusual Non-Managed Device severity low T1078, T1078.004, T1098, T1098.005
M365 or Entra ID Identity Sign-in from a Suspicious Source severity high T1078

Splunk (5)

Azure AD Device Code Authentication severity medium T1528, T1566, T1566.002
Azure AD Multi-Source Failed Authentications Spike T1110, T1110.003, T1110.004, T1586, T1586.003
Azure AD Multiple Denied MFA Requests For User severity medium T1621
Azure AD User Consent Denied for OAuth Application severity medium T1528
Detect Distributed Password Spray Attempts T1110, T1110.003

Kusto (38)

[Deprecated] Explicit MFA Deny severity medium T1110
Account Created and Deleted in Short Timeframe severity high T1078, T1078.004
Account created from non-approved sources severity medium T1136, T1136.003
Anomalous login followed by Teams action severity medium T1078, T1098, T1136, T1199
Anomaly Sign In Event from an IP severity medium T1078
Attempt to bypass conditional access rule in Microsoft Entra ID severity low T1078, T1098
Attempts to sign in to disabled accounts severity medium T1078
Authentication Attempt from New Country severity medium T1078, T1078.004
Brute force attack against Azure Portal severity medium T1110
Brute Force Attack against GitHub Account severity medium T1110
Detect device code login with user risk T1078, T1078.004
Detect Direct Send phishing emails T1566
Distributed Password cracking attempts in Microsoft Entra ID severity medium T1110
Failed AzureAD logons but success logon to AWS Console severity medium T1078, T1110
Failed AzureAD logons but success logon to host severity medium T1078, T1110
Failed host logons but success logon to AzureAD severity medium T1078, T1110
Failed login attempts to Azure Portal severity low T1110
GitHub Signin Burst from Multiple Locations severity medium T1110
GreyNoise TI Map IP Entity to SigninLogs severity medium T1071
HoneyLabs TI Map IP Entity to SigninLogs severity medium T1110, T1190
Insider Risk_Sensitive Data Access Outside Organizational Geo-location severity high T1567
IP with multiple failed Microsoft Entra ID logins successfully logs in to Palo Alto VPN severity medium T1078, T1110
Log4j vulnerability exploit aka Log4Shell IP IOC severity high T1071
Lumen TI IPAddress in SigninLogs severity medium T1071
Malformed user agent severity medium T1071, T1189, T1203
Microsoft Entra ID PowerShell accessing non-Entra ID resources severity low T1078
Password spray attack against Microsoft Entra ID application severity medium T1110
Power Apps - App activity from unauthorized geo severity low T1078
Privileged Accounts - Sign in Failure Spikes severity high T1078, T1078.004
Sign-ins from IPs that attempt sign-ins to disabled accounts severity medium T1078, T1098
Successful logon from IP and failure from a different IP severity medium T1078, T1110
ThreatConnect TI map Email entity to SigninLogs severity medium T1071
TI Map Email entity to SigninLogs severity medium T1566
TI map Email entity to SigninLogs severity medium T1566
TI Map IP Entity to SigninLogs severity medium T1071
TI Map IP Entity to SigninLogs severity medium T1071
User Accounts - Sign in Failure due to CA Spikes severity medium T1078, T1078.004
User agent search for log4j exploitation attempt severity high T1190

YARA-L (5)

Entra ID Admin Login Activity to Uncommon MS Cloud Apps severity medium T1078, T1078.004
Entra ID Login Activity to Azure AD PowerShell Application severity medium
Entra ID Login Activity to Uncommon MS Cloud Apps severity low T1078, T1078.004
GeoIP User Login From Multiple States Or Countries severity low
Microsoft Entra ID Device code phishing attack severity high T1566

Panther (12)

Azure Device Code Authentication with Broker Client severity medium T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Azure Excessive Account Lockouts severity high T1110, T1110.001, T1110.003, T1110.004
Azure High-Risk Sign-In severity high T1078
Azure Many Failed SignIns severity medium T1078, T1110
Azure Microsoft Graph Single Session from Multiple IP Addresses severity medium T1078, T1078.004, T1550, T1550.001
Azure Protection Multiple Alerts for User severity high T1078, T1078.004
Azure RiskLevel Passthrough severity medium T1078, T1110
Azure ROPC Login Attempt Without MFA severity medium T1078, T1078.004
Azure SignIn via Legacy Authentication Protocol severity medium
Azure VS Code OAuth Phishing severity medium T1528, T1566
Microsoft Entra ID First Time Seen Device Code Authentication
Sign In from Rogue State severity medium T1078.004

Success

32 detection rules reference this event. View event page.

Sigma (5)

Azure AD Only Single Factor Authentication Required severity low T1078, T1078.004, T1556, T1556.006
Discovery Using AzureHound severity high T1087, T1087.004, T1526
Potential MFA Bypass Using Legacy Client Authentication severity high T1078, T1078.004, T1110
Sign-ins by Unknown Devices severity low T1078, T1078.004
Suspicious SignIns From A Non Registered Device severity high T1078

Elastic (1)

Microsoft Entra ID Impossible Travel Sign-in severity high T1078, T1078.004, T1528, T1557

Splunk (4)

Azure AD Multiple AppIDs and UserAgents Authentication Spike severity low T1078
Azure AD Successful Authentication From Different Ips severity medium T1110, T1110.001, T1110.003
Azure AD Successful PowerShell Authentication severity medium T1078, T1078.004, T1586, T1586.003
Azure AD Successful Single-Factor Authentication severity medium T1078, T1078.004, T1586, T1586.003

Kusto (22)

[Entra ID] Suspicious Continuous OAuth Token Usage severity high T1606
Anomalous sign-in location by user account and authenticating application severity medium T1078
Anomalous Single Factor Signin severity low T1078, T1078.004
Authentications of Privileged Accounts Outside of Expected Controls severity medium T1078, T1078.004
Azure Portal sign in from another Azure Tenant severity medium T1199
Cisco - firewall block but success logon to Microsoft Entra ID severity medium T1078
Detect non-admin requesting token for admin applications T1651
F&O - Unusual sign-in activity using single factor authentication severity low T1078, T1552
Failed AWS Console logons but success logon to AzureAD severity medium T1078, T1110
GitLab - SSO - Sign-Ins Burst severity medium T1110
High risk Office operation conducted by IP Address that recently attempted to log into a disabled account severity medium T1078, T1098, T1114
M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity severity medium T1078
Microsoft Entra ID Rare UserAgent App Sign-in severity medium T1036
Microsoft Entra ID UserAgent OS Missmatch severity medium T1036
New country signIn with correct password severity medium T1078, T1110
Possible AiTM Phishing Attempt Against Microsoft Entra ID severity medium T1078, T1078.004, T1111, T1557
Possible SignIn from Azure Backdoor severity medium T1098
Privileged User Logon from new ASN severity medium T1078, T1078.004
PRODAFT USTA - Compromised credential used in successful sign-in severity high T1078, T1555
Risky user signin observed in non-Microsoft network device severity medium T1071
Suspicious Login from deleted guest account severity medium T1078, T1078.004
Unusual Volume of file deletion by users severity high T1485

Invalid-credentials

6 detection rules reference this event. View event page.

Elastic (2)

Entra ID Sign-in Brute Force Attempted (Microsoft 365) severity medium T1110, T1110.001, T1110.003, T1110.004
Entra ID User Sign-in Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

Splunk (4)

Azure AD High Number Of Failed Authentications For User severity medium T1110, T1110.001
Azure AD High Number Of Failed Authentications From Ip severity medium T1110, T1110.001, T1110.003
Azure AD Multiple Users Failing To Authenticate From Ip severity low T1110, T1110.003, T1110.004, T1586, T1586.003
Azure AD Unusual Number of Failed Authentications From Ip severity low T1110, T1110.003, T1110.004, T1586, T1586.003

Account-locked

2 detection rules reference this event. View event page.

Sigma (1)

Account Lockout severity medium T1110

Elastic (1)

Entra ID Excessive Account Lockouts Detected severity high T1110, T1110.001, T1110.003, T1110.004

Password-expired

2 detection rules reference this event. View event page.

Elastic (2)

Entra ID Sign-in Brute Force Attempted (Microsoft 365) severity medium T1110, T1110.001, T1110.003, T1110.004
Entra ID User Sign-in Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

Disabled

5 detection rules reference this event. View event page.

Sigma (2)

Account Disabled or Blocked for Sign in Attempts severity medium T1078, T1078.004
Login to Disabled Account severity medium T1078, T1078.004

Elastic (2)

Entra ID Sign-in Brute Force Attempted (Microsoft 365) severity medium T1110, T1110.001, T1110.003, T1110.004
Entra ID User Sign-in Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

Kusto (1)

High risk Office operation conducted by IP Address that recently attempted to log into a disabled account severity medium T1078, T1098, T1114

MFA-challenged

8 detection rules reference this event. View event page.

Sigma (1)

Multifactor Authentication Interrupted severity medium T1078, T1078.004, T1110, T1621

Elastic (2)

Entra ID Sign-in Brute Force Attempted (Microsoft 365) severity medium T1110, T1110.001, T1110.003, T1110.004
Entra ID User Sign-in Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

Splunk (2)

Azure AD Authentication Failed During MFA Challenge severity medium T1078, T1078.004, T1586, T1586.003, T1621
Azure AD Multiple Failed MFA Requests For User severity medium T1078, T1078.004, T1586, T1586.003, T1621

Kusto (3)

Cisco - firewall block but success logon to Microsoft Entra ID severity medium T1078
Failed sign-ins into LastPass due to MFA severity low T1078, T1190
MFA Rejected by User severity medium T1078, T1078.004

Blocked-by-CA

3 detection rules reference this event. View event page.

Sigma (3)

Azure Unusual Authentication Interruption severity medium T1078
Sign-in Failure Due to Conditional Access Requirements Not Met severity high T1078, T1078.004, T1110
User Access Blocked by Azure Conditional Access severity medium T1078, T1078.004, T1110

Other

6 detection rules reference this event. View event page.

Sigma (1)

Azure Unusual Authentication Interruption severity medium T1078

Elastic (2)

Entra ID Sign-in Brute Force Attempted (Microsoft 365) severity medium T1110, T1110.001, T1110.003, T1110.004
Entra ID User Sign-in Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

Kusto (3)

Detect non-admin requesting token for admin applications T1651
Expired access credentials being used in Azure severity medium T1528
Failed AWS Console logons but success logon to AzureAD severity medium T1078, T1110

Identity Protection (risk)

6 detection rules reference this event. View event page.

Sigma (1)

Suspicious SignIns From A Non Registered Device severity high T1078

Kusto (5)

High-Risk Cross-Cloud User Impersonation severity medium T1078, T1078.002, T1078.004, T1134
Insider Risk_Risky User Access By Application severity medium T1204
Possible AiTM Phishing Attempt Against Microsoft Entra ID severity medium T1078, T1078.004, T1111, T1557
Risky user signin observed in non-Microsoft network device severity medium T1071
Unusual Volume of file deletion by users severity high T1485

Target application

19 detection rules reference this event. View event page.

Sigma (1)

Device Registration or Join Without MFA severity medium T1078, T1078.004

Elastic (1)

Entra ID Sign-in Brute Force Attempted (Microsoft 365) severity medium T1110, T1110.001, T1110.003, T1110.004

Splunk (1)

Azure AD Successful PowerShell Authentication severity medium T1078, T1078.004, T1586, T1586.003

Kusto (16)

Azure Portal sign in from another Azure Tenant severity medium T1199
Brute force attack against an Entra-authenticated Windows device severity medium T1110
Cross-Cloud Password Spray detection severity medium T1110
Cross-Cloud Unauthorized Credential Access Detection From AWS RDS Login severity medium T1110, T1110.003, T1110.004, T1133, T1556, T1557
Dataverse - Suspicious use of Web API severity medium T1106, T1526, T1567, T1580, T1595
Detect Multiple Hello for Business PRT tokens being used simultaneously for one device. T1606
Detect non-admin requesting token for admin applications T1651
Expired access credentials being used in Azure severity medium T1528
External guest invitation followed by Microsoft Entra ID PowerShell signin severity medium T1078, T1078.004, T1087, T1087.004, T1136, T1136.003
F&O - Unusual sign-in activity using single factor authentication severity low T1078, T1552
Failed sign-ins into LastPass due to MFA severity low T1078, T1190
GitLab - SSO - Sign-Ins Burst severity medium T1110
High-Risk Cross-Cloud User Impersonation severity medium T1078, T1078.002, T1078.004, T1134
Insider Risk_Risky User Access By Application severity medium T1204
Power Platform - Possibly compromised user accesses Power Platform services severity high T1078, T1210
Unauthorized user access across AWS and Azure severity medium T1048, T1087, T1110, T1110.003, T1110.004, T1212

Authentication requirement

10 detection rules reference this event. View event page.

Sigma (4)

Azure AD Only Single Factor Authentication Required severity low T1078, T1078.004, T1556, T1556.006
Multifactor Authentication Denied severity medium T1078, T1078.004, T1110, T1621
Sign-ins by Unknown Devices severity low T1078, T1078.004
Suspicious SignIns From A Non Registered Device severity high T1078

Elastic (2)

Entra ID Excessive Account Lockouts Detected severity high T1110, T1110.001, T1110.003, T1110.004
Entra ID User Sign-in Brute Force Attempted severity medium T1110, T1110.001, T1110.003, T1110.004

Splunk (2)

Azure AD Multiple AppIDs and UserAgents Authentication Spike severity low T1078
Azure AD Successful Single-Factor Authentication severity medium T1078, T1078.004, T1586, T1586.003

Kusto (2)

Anomalous Single Factor Signin severity low T1078, T1078.004
MFA Spamming followed by Successful login severity high T1110

Conditional Access status

1 detection rules reference this event. View event page.

Sigma (1)

Device Registration or Join Without MFA severity medium T1078, T1078.004

Client app (legacy authentication)

1 detection rules reference this event. View event page.

Sigma (1)

Use of Legacy Authentication Protocols severity high T1078, T1078.004, T1110