Azure Unusual Authentication Interruption

Status: test
Severity: medium
Log source: product azure, service signinlogs
Author: Austin Songer @austinsonger
Source: github.com/SigmaHQ/sigma

Detects when there is a interruption in the authentication process.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts
Privilege Escalation	`T1078` Valid Accounts
Stealth	`T1078` Valid Accounts

Telemetry coverage

Platform	Record / event type
Entra ID	`SigninLogs` sign-in event: Sign-in blocked by Conditional Access
Entra ID	`SigninLogs` sign-in event: Sign-in with another recorded result

Rule body

title: Azure Unusual Authentication Interruption
id: 8366030e-7216-476b-9927-271d79f13cf3
status: test
description: Detects when there is a interruption in the authentication process.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
author: Austin Songer @austinsonger
date: 2021-11-26
modified: 2022-12-18
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078
logsource:
    product: azure
    service: signinlogs
detection:
    selection_50097:
        ResultType: 50097
        ResultDescription: 'Device authentication is required'
    selection_50155:
        ResultType: 50155
        ResultDescription: 'DeviceAuthenticationFailed'
    selection_50158:
        ResultType: 50158
        ResultDescription: 'ExternalSecurityChallenge - External security challenge was not satisfied'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_50097`

selection_50097:
    ResultType: 50097
    ResultDescription: 'Device authentication is required'

Stage 2: `selection_50155`

selection_50155:
    ResultType: 50155
    ResultDescription: 'DeviceAuthenticationFailed'

Stage 3: `selection_50158`

selection_50158:
    ResultType: 50158
    ResultDescription: 'ExternalSecurityChallenge - External security challenge was not satisfied'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ResultDescription`	eq	`Device authentication is required` `DeviceAuthenticationFailed` `ExternalSecurityChallenge - External security challenge was not satisfied`	`field:"azure_ad::result_reason" kind:eq`
`ResultType`	eq	`50097` `50155` `50158`	`field:"ResultType" kind:eq`

Azure Unusual Authentication Interruption

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_50097

Stage 2: selection_50155

Stage 3: selection_50158

Indicators

Stage 0: `condition`

Stage 1: `selection_50097`

Stage 2: `selection_50155`

Stage 3: `selection_50158`