Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource

[metadata]
creation_date = "2026/05/15"
integration = ["azure"]
maturity = "production"
updated_date = "2026/07/08"

[rule]
author = ["Elastic"]
description = """
Detects successful Microsoft Entra ID sign-ins where the client application is the Microsoft Authentication Broker
(MAB) and the requested resource identifier is outside a short list of commonly observed first-party targets. Attackers
abuse the broker in phishing and token broker flows to obtain tokens for unexpected APIs or enterprise applications.
The exclusion list covers legacy Azure Active Directory, Microsoft Graph, Device Registration Service, Microsoft Intune
Enrollment, extend or tune exclusions for your tenant after baselining broker traffic.
"""
false_positives = [
    """
    Legitimate broker sign-ins to first-party Microsoft resources that use alternate well-known IDs, regional variants,
    or new Microsoft services not yet in the exclusion list may match. Third-party applications that integrate with MAB
    for delegated authentication can also appear. Baseline `resource_id` and `resource_display_name` for your
    environment and add exclusions for approved resources.
    """,
]
from = "now-9m"
index = ["logs-azure.signinlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource"
note = """## Triage and analysis

### Investigating Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource

Review `azure.signinlogs.properties.user_principal_name`, `azure.signinlogs.properties.resource_id`,
`azure.signinlogs.properties.resource_display_name`, `azure.signinlogs.properties.session_id`, `source.ip`, and
`user_agent.original`.

Determine whether the resource is a known line-of-business application, partner integration, or Microsoft service not
represented in the rule exclusion list.

### Possible investigation steps

- Resolve `resource_id` in Entra ID enterprise applications and compare with change records or app governance inventory.
- Correlate with `azure.signinlogs` and `azure.graphactivitylogs` for follow-on API calls from the same session.
- Review conditional access results and risk detections for the same user and time window.

### Response and remediation

- If unauthorized, revoke refresh tokens for the user, review consent and app permissions, and reset credentials per policy.
- Escalate per incident procedures when the resource corresponds to sensitive APIs or high-privilege applications.
"""
references = [
    "https://learn.microsoft.com/en-us/troubleshoot/azure/entra/entra-id/governance/verify-first-party-apps-sign-in",
    "https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs",
    "https://any.run/malware-trends/tycoon/",
]
risk_score = 73
rule_id = "4f95e0f8-18b7-459a-b8b5-b2f5c94bf6eb"
severity = "high"
setup = """
Microsoft Entra ID sign-in logs (`logs-azure.signinlogs-*`) must include `azure.signinlogs.properties.app_id` and
`azure.signinlogs.properties.resource_id`. Tune the exclusion list for first-party resource identifiers your tenant
expects from the Microsoft Authentication Broker.
"""
tags = [
    "Domain: Cloud",
    "Domain: Identity",
    "Data Source: Azure",
    "Data Source: Microsoft Entra ID",
    "Data Source: Microsoft Entra ID Sign-in Logs",
    "Use Case: Threat Detection",
    "Tactic: Initial Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
data_stream.dataset:"azure.signinlogs" and event.category:"authentication" and event.action:"Sign-in activity" and
event.outcome:success and azure.signinlogs.properties.app_id:"29d9ed98-a469-4536-ade2-f981bc1d605e" and
azure.signinlogs.properties.resource_id:(* and not 
    ("00000002-0000-0000-c000-000000000000" or
    "90a2e5d2-fd7a-4a2e-bc90-3dc50ae8e3ee" or
    "01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9" or
    "d4ebce55-015a-49b5-a083-c84d1797ae8c" or
    "00000003-0000-0000-c000-000000000000" or 
    "0a5f63c0-b750-4f38-a71c-4fc0d58b89e2")
)
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "user.name",
    "user_agent.original",
    "source.ip",
    "source.geo.country_name",
    "event.outcome",
    "azure.signinlogs.properties.user_principal_name",
    "azure.signinlogs.properties.session_id",
    "azure.signinlogs.properties.app_id",
    "azure.signinlogs.properties.app_display_name",
    "azure.signinlogs.properties.resource_id",
    "azure.signinlogs.properties.resource_display_name",
    "azure.signinlogs.properties.authentication_protocol",
    "azure.tenant_id",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1078"
name = "Valid Accounts"
reference = "https://attack.mitre.org/techniques/T1078/"

[[rule.threat.technique.subtechnique]]
id = "T1078.004"
name = "Cloud Accounts"
reference = "https://attack.mitre.org/techniques/T1078/004/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1550"
name = "Use Alternate Authentication Material"
reference = "https://attack.mitre.org/techniques/T1550/"

[[rule.threat.technique.subtechnique]]
id = "T1550.001"
name = "Application Access Token"
reference = "https://attack.mitre.org/techniques/T1550/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"