Azure secure score block legacy authentication

Status: available
Severity: high
Time window: 6h
Source: github.com/Azure/Azure-Sentinel

'This query searches for most compromising sign-in attempts come from legacy authentication. Older office clients such as Office 2010 do not support modern authentication and use legacy protocols such as IMAP, SMTP, and POP3. Legacy authentication does not support multi-factor authentication (MFA). Even if an MFA policy is configured in your environment, bad actors can bypass these enforcements through legacy protocols.'

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1212` Exploitation for Credential Access `T1556` Modify Authentication Process

Rule body

id: C27BB559-28C5-4924-A7DA-3BF04CD02C8F
name: Azure secure score block legacy authentication
description: |
  'This query searches for most compromising sign-in attempts come from legacy authentication. 
   Older office clients such as Office 2010 do not support modern authentication and use legacy protocols such as IMAP, SMTP, and POP3. 
   Legacy authentication does not support multi-factor authentication (MFA).
   Even if an MFA policy is configured in your environment, bad actors can bypass these enforcements through legacy protocols.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: SenservaPro
    dataTypes:
      - SenservaPro_CL
queryFrequency: 6h
queryPeriod: 6h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1212
  - T1556
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScoreBlockLegacyAuthentication'
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: ControlName_s
      - identifier: AadTenantId
        columnName: TenantId
      - identifier: DisplayName
        columnName: TenantDisplayName_s 
  - entityType: SecurityGroup
    fieldMappings:
      - identifier: DistinguishedName
        columnName: Group_s
  - entityType: AzureResource
    fieldMappings:
      - identifier: ResourceId
        columnName: SourceSystem 
version: 1.0.1
kind: Scheduled

Stages and Predicates

Stage 1: `source`

SenservaPro_CL

Stage 2: `where`

| where ControlName_s == 'AzureSecureScoreBlockLegacyAuthentication'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ControlName_s`	eq	`AzureSecureScoreBlockLegacyAuthentication`	`field:"ControlName_s" kind:eq value:"AzureSecureScoreBlockLegacyAuthentication"`