Applications That Are Using ROPC Authentication Flow

Status: test
Severity: medium
Log source: product azure, service signinlogs
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
Source: github.com/SigmaHQ/sigma

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.

Known false positives

Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts
Privilege Escalation	`T1078` Valid Accounts
Stealth	`T1078` Valid Accounts

Telemetry coverage

Platform	Record / event type
Entra ID	`SigninLogs` sign-in event: Sign-in record (SigninLogs, any result)

Rule body

title: Applications That Are Using ROPC Authentication Flow
id: 55695bc0-c8cf-461f-a379-2535f563c854
status: test
description: |
    Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.
    The application then uses those credentials to authenticate the user against the identity provider.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
date: 2022-06-01
tags:
    - attack.stealth
    - attack.t1078
    - attack.persistence
    - attack.privilege-escalation
    - attack.initial-access
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        properties.message: ROPC
    condition: selection
falsepositives:
    - Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    properties.message: ROPC

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`properties.message`	eq	`ROPC`	`field:"properties.message" kind:eq value:"ROPC"`