Entra ID User Sign-in with Unusual Client

ELASTIC detection rule by Elastic · Elastic License v2

Detects rare non-interactive sign-ins where an Entra ID client application authenticates on behalf of a principal user using an application (client) ID that is not commonly associated with that user's historical sign-in behavior. Adversaries with stolen credentials or OAuth tokens may abuse Entra ID–managed or first-party client IDs to perform on-behalf-of (OBO) authentication, blending into legitimate cloud traffic while avoiding traditional interactive sign-in flows. This technique is commonly observed in OAuth phishing, token theft, and access broker operations, and may precede lateral movement, persistence, or data access via Microsoft Graph or other cloud resources. The rule uses a New Terms approach to identify first-seen combinations of the UPN and Client ID within a defined history window, helping surface unexpected client usage that may indicate compromised identities, malicious automation, or unauthorized application impersonation.

[metadata]
creation_date = "2025/03/10"
integration = ["azure"]
maturity = "production"
updated_date = "2026/08/12"

[rule]
author = ["Elastic"]
description = """
Detects rare non-interactive sign-ins where an Entra ID client application authenticates on behalf of a principal user
using an application (client) ID that is not commonly associated with that user's historical sign-in behavior.
Adversaries with stolen credentials or OAuth tokens may abuse Entra ID–managed or first-party client IDs to perform
on-behalf-of (OBO) authentication, blending into legitimate cloud traffic while avoiding traditional interactive sign-in
flows. This technique is commonly observed in OAuth phishing, token theft, and access broker operations, and may precede
lateral movement, persistence, or data access via Microsoft Graph or other cloud resources. The rule uses a New Terms
approach to identify first-seen combinations of the UPN and Client ID within a defined history window, helping surface
unexpected client usage that may indicate compromised identities, malicious automation, or unauthorized application
impersonation.
"""
from = "now-9m"
index = ["filebeat-*", "logs-azure.signinlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID User Sign-in with Unusual Client"
note = """## Triage and analysis

### Investigating Entra ID User Sign-in with Unusual Client

This rule identifies rare Azure Entra apps IDs requesting authentication on-behalf-of a principal user. An adversary with stolen credentials may specify an Azure-managed app ID to authenticate on-behalf-of a user. This is a rare event and may indicate an attempt to bypass conditional access policies (CAP) and multi-factor authentication (MFA) requirements. The app ID specified may not be commonly used by the user based on their historical sign-in activity.

### Possible investigation steps

- Identify the source IP address from which the failed login attempts originated by reviewing `source.ip`. Determine if the IP is associated with known malicious activity using threat intelligence sources or if it belongs to a corporate VPN, proxy, or automation process.
- Analyze affected user accounts by reviewing `azure.signinlogs.properties.user_principal_name` to determine if they belong to privileged roles or high-value users. Look for patterns indicating multiple failed attempts across different users, which could suggest a password spraying attempt.
- Examine the authentication method used in `azure.signinlogs.properties.authentication_details` to identify which authentication protocols were attempted and why they failed. Legacy authentication methods may be more susceptible to brute-force attacks.
- Review the authentication error codes found in `azure.signinlogs.properties.status.error_code` to understand why the login attempts failed. Common errors include `50126` for invalid credentials, `50053` for account lockouts, `50055` for expired passwords, and `50056` for users without a password.
- Correlate failed logins with other sign-in activity by looking at `event.outcome`. Identify if there were any successful logins from the same user shortly after multiple failures or if there are different geolocations or device fingerprints associated with the same account.
- Review `azure.signinlogs.properties.app_id` to identify which applications were initiating the authentication attempts. Determine if these applications are Microsoft-owned, third-party, or custom applications and if they are authorized to access the resources.
- Check for any conditional access policies that may have been triggered by the failed login attempts by reviewing `azure.signinlogs.properties.authentication_requirement`. This can help identify if the failed attempts were due to policy enforcement or misconfiguration.

## False positive analysis

- Automated scripts or applications using non-interactive authentication may trigger this detection, particularly if they rely on legacy authentication protocols recorded in `azure.signinlogs.properties.authentication_protocol`.
- Corporate proxies or VPNs may cause multiple users to authenticate from the same IP, appearing as repeated failed attempts under `source.ip`.
- User account lockouts from forgotten passwords or misconfigured applications may show multiple authentication failures in `azure.signinlogs.properties.status.error_code`.
- Exclude known trusted IPs, such as corporate infrastructure, from alerts by filtering `source.ip`.
- Exclude known custom applications from `azure.signinlogs.properties.app_id` that are authorized to use non-interactive authentication.
- Microsoft Feedback Portal UX generates benign first-seen client activity through PRT-based, non-interactive sign-ins and is excluded by application ID.
- Microsoft Teams routinely requests tokens for its internal Teams Services, IC3 Gateway, Chat Aggregator, and CMD Services resources; these client-resource combinations are excluded.
- Managed Windows devices routinely request OfficeHome PRTs with Microsoft 365 Copilot scopes through the standard Microsoft 365 desktop client; this combination is excluded.
- Ignore principals with a history of failed logins due to legitimate reasons, such as expired passwords or account lockouts, by filtering `azure.signinlogs.properties.user_principal_name`.
- Correlate sign-in failures with password reset events or normal user behavior before triggering an alert.

## Response and remediation

- Block the source IP address in `source.ip` if determined to be malicious.
- Reset passwords for all affected user accounts listed in `azure.signinlogs.properties.user_principal_name` and enforce stronger password policies.
- Ensure basic authentication is disabled for all applications using legacy authentication protocols listed in `azure.signinlogs.properties.authentication_protocol`.
- Enable multi-factor authentication (MFA) for impacted accounts to mitigate credential-based attacks.
- Review conditional access policies to ensure they are correctly configured to block unauthorized access attempts recorded in `azure.signinlogs.properties.authentication_requirement`.
- Review Conditional Access policies to enforce risk-based authentication and block unauthorized access attempts recorded in `azure.signinlogs.properties.authentication_requirement`.
- Implement a zero-trust security model by enforcing least privilege access and continuous authentication.
- Regularly review and update conditional access policies to ensure they are effective against evolving threats.
- Restrict the use of legacy authentication protocols by disabling authentication methods listed in `azure.signinlogs.properties.client_app_used`.
- Regularly audit authentication logs in `azure.signinlogs` to detect abnormal login behavior and ensure early detection of potential attacks.
- Regularly rotate client credentials and secrets for applications using non-interactive authentication to reduce the risk of credential theft.
"""
references = ["https://securityscorecard.com/wp-content/uploads/2025/02/MassiveBotnet-Report_022125_03.pdf"]
risk_score = 47
rule_id = "c766bc56-fdca-11ef-b194-f661ea17fbcd"
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Entra ID",
    "Data Source: Entra ID Sign-in",
    "Platform: Entra ID",
    "Use Case: Identity and Access Audit",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "azure.signinlogs" and event.category: "authentication"
    and azure.signinlogs.properties.is_interactive: false
    and azure.signinlogs.properties.user_type: "Member"
    and not azure.signinlogs.properties.client_app_used: "Browser"
    and not source.as.organization.name: "MICROSOFT-CORP-MSN-AS-BLOCK"
    and not azure.signinlogs.properties.app_id: (
        "1b3c667f-cde3-4090-b60b-3d2abd0117f0" or
        "26a7ee05-5602-4d76-a7ba-eae8b7b67941" or
        "4b0964e4-58f1-47f4-a552-e2e1fc56dcd7" or
        "ecd6b820-32c2-49b6-98a6-444530e5a77a" or
        "268761a2-03f3-40df-8a8b-c3db24145b6b" or
        "fc0f3af4-6835-4174-b806-f7db311fd2f3" or
        "de50c81f-5f80-4771-b66b-cebd28ccdfc1" or
        "ab9b8c07-8f02-4f72-87fa-80105867a763" or
        "6f7e0f60-9401-4f5b-98e2-cf15bd5fd5e3" or
        "d7b530a4-7680-4c23-a8bf-c52c121d2e87" or
        "52c2e0b5-c7b6-4d11-a89c-21e42bcec444" or
        "38aa3b87-a06d-4817-b275-7a316988d93b" or
        "27922004-5251-4030-b22d-91ecd9a37ea4" or
        "9ba1a5c7-f17a-4de9-a1f1-6178c8d51223" or
        "cab96880-db5b-4e15-90a7-f3f1d62ffe39" or
        "3a4d129e-7f50-4e0d-a7fd-033add0a29f4" or
        "29d9ed98-a469-4536-ade2-f981bc1d605e" or
        "c0ab8ce9-e9a0-42e7-b064-33d422df41f1" or
        "9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7" or
        "4813382a-8fa7-425e-ab75-3b753aab3abb" or
        "08e18876-6177-487e-b8b5-cf950c1e598c" or
        "0ec893e0-5785-4de6-99da-4ed124e5296c" or
        "d3590ed6-52b3-4102-aeff-aad2292ab01c" or
        "0dc2408a-bbc0-4238-871e-13b372f0200f" or
        "af124e86-4e96-495a-b70a-90f90ab96707" or
        "e9c51622-460d-4d3d-952d-966a5b1da34c" or
        "f44b1140-bc5e-48c6-8dc0-5cf5a53c0e34" or
        "e2ef5054-0287-4db6-afa3-013d96881fd3" or
        "82864fa0-ed49-4711-8395-a0e6003dca1f" or
        "60c8bde5-3167-4f92-8fdb-059f6176dc0f" or
        "5d661950-3475-41cd-a2c3-d671a3162bc1" or
        "145fc680-eb72-4bcf-b4d5-8277021a1ce8" or
        "c1c74fed-04c9-4704-80dc-9f79a2e515cb" or
        "a2760c41-63c9-42b5-8d58-bfa1fd9e2eb3" or
        "6dec647e-42c4-45a6-8f13-e8250d34e033" or
        "c98e5057-edde-4666-b301-186a01b4dc58" or
        "0a31c71e-0abf-4238-add7-b1a24c165dc1" or
        "a8759234-4b8b-4d94-8c0a-ee1ab73af270" or
        "dae89220-69ba-4957-a77a-47b78695e883" or
        "fd5f78f6-a28f-450b-abc7-777f3dbbfcba" or
        "821caec6-bec3-4542-bead-d3c5fb6b4ef0" or
        "a40d7d7d-59aa-447e-a655-679a4107e548" or
        "bed12bc0-3a62-470d-998c-e47546e7b039" or
        "f4060917-6abe-40d7-baa6-f634c0eda4ac" or
        "b26aadf8-566f-4478-926f-589f601d9c74" or
        "1f7f6f43-2f81-429c-8499-293566d0ab0c" or
        "75f31797-37c9-498e-8dc9-53c16a36afca" or
        "3e050dd7-7815-46a0-8263-b73168a42c10" or
        "243c63a3-247d-41c5-9d83-7788c43f1c43" or
        "75efb5bc-18a1-4e7b-8a66-2ad2503d79c6" or
        "d32f3b53-b7d7-48df-8d0f-f8bf233b3f1f" or
        "95de633a-083e-42f5-b444-a4295d8e9314" or
        "3ff8e6ba-7dc3-4e9e-ba40-ee12b60d6d48" or
        "871c010f-5e61-4fb1-83ac-98610a7e9110" or
        "3e62f81e-590b-425b-9531-cad6683656cf" or
        "8ec6bc83-69c8-4392-8f08-b3c986009232" or
        "d326c1ce-6cc6-4de2-bebc-4591e5e13ef0" or
        "dd762716-544d-4aeb-a526-687b73838a22" or
        "7f8f922d-7ee4-40a6-b435-aad8b84ebde0" or
        "f8d98a96-0999-43f5-8af3-69971c7bb423" or
        "aa580612-c342-4ace-9055-8edee43ccb89" or
        "7f67af8a-fedc-4b08-8b4e-37c4d127b6cf" or
        "00bf137d-f689-4c5d-83d9-7fc31904a7ea" or
        "ceb96695-e468-48ba-ba21-35e2a242d396" or
        "7fba38f4-ec1f-458d-906c-f4e3c4f41335" or
        "a2a1fecc-b06e-4a1e-95c1-2afd94bcadff" or
        "15ddab63-ba81-45db-9bb6-6f8bc445c459" or
        "bc59ab01-8403-45c6-8796-ac3ef710b3e3" or
        "00000003-0000-0ff1-ce00-000000000000" or
        "4e291c71-d680-4d0e-9640-0a3358e31177" or
        "4fb5cc57-dbbc-4cdc-9595-748adff5f414" or
        "22098786-6e16-43cc-a27d-191a01a1e3b5" or
        "ebde7daf-df42-4ade-81a4-d67b339b49e9" or
        "c0d2a505-13b8-4ae0-aa9e-cddd5eab0b12" or
        "a672d62c-fc7b-4e81-a576-e60dc46e951d" or
        "0b1df6d3-2deb-44d4-b44b-7101937e0726" or
        "04f0c124-f2bc-4f59-8241-bf6df9866bbd" or
        "86f4c005-6582-4559-b6cf-8b3111236736" or
        "a0a3c1d3-7b82-4010-bdb0-e7048fb8f1fe" or
        "a187e399-0c36-4b98-8f04-1edc167a0996" or
        "2d4d3d8e-2be3-4bef-9f87-7875a61c29de" or
        "c475db56-f463-48d8-931a-cfa7cd642289" or
        "71a7c376-13e6-4100-968e-92ce98c5d3d2"
    )
    and not (
        azure.signinlogs.properties.app_id: "1fec8e78-bce4-4aaf-ab1b-5451cc387264" and
        azure.signinlogs.properties.resource_id: (
            "cc15fd57-2c6c-4117-a88c-83b1d56b4bbe" or
            "39aaf054-81a5-48c7-a4f8-0293012095b9" or
            "b1379a75-ce5e-4fa3-80c6-89bb39bf646c" or
            "6bc3b958-689b-49f5-9006-36d165f30e00"
        )
    )
    and not (
        azure.signinlogs.properties.app_id: "4765445b-32c6-49b0-83e6-1d93765276ca" and
        azure.signinlogs.properties.resource_id: "4765445b-32c6-49b0-83e6-1d93765276ca" and
        azure.signinlogs.properties.authentication_processing_details: *M365Copilot.Read.All* and
        azure.signinlogs.properties.incoming_token_type: "primaryRefreshToken" and
        azure.signinlogs.properties.client_app_used: "Mobile Apps and Desktop clients" and
        azure.signinlogs.properties.device_detail.is_managed: true and
        azure.signinlogs.properties.device_detail.operating_system: "Windows10" and
        user_agent.original: Mozilla*Edge/18.*
    )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"

[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[rule.investigation_fields]
field_names = [
    "azure.signinlogs.properties.user_principal_name",
    "azure.signinlogs.properties.user_id",
    "azure.signinlogs.properties.app_id",
    "azure.signinlogs.properties.app_display_name",
    "azure.signinlogs.properties.client_app_used",
    "azure.signinlogs.properties.incoming_token_type",
    "azure.signinlogs.properties.authentication_protocol",
    "azure.signinlogs.properties.authentication_requirement",
    "azure.signinlogs.properties.token_issuer_type",
    "azure.signinlogs.properties.resource_display_name",
    "source.ip",
    "source.as.number",
    "source.geo.country_name",
    "azure.signinlogs.properties.correlation_id",
    "azure.signinlogs.properties.session_id",
]

[rule.new_terms]
field = "new_terms_fields"
value = ["azure.signinlogs.properties.user_principal_name", "azure.signinlogs.properties.app_id"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-14d"

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

51148f90-45e1-4b44-973f-f8d30509083f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion