Azure SignIn via Legacy Authentication Protocol

Description

This detection looks for Successful Logins that have used legacy authentication protocols

Query · python

import json
from unittest.mock import MagicMock

from panther_azuresignin_helpers import actor_user, azure_signin_alert_context, is_sign_in_event

LEGACY_AUTH_USERAGENTS = ["BAV2ROPC", "CBAInPROD"]  # CBAInPROD is reported to be IMAP

# Add ServicePrincipalName/UserPrincipalName to
# KNOWN_EXCEPTIONS to prevent these Principals from Alerting
KNOWN_EXCEPTIONS = []


def rule(event):
    if not is_sign_in_event(event):
        return False

    global KNOWN_EXCEPTIONS  # pylint: disable=global-statement
    if isinstance(KNOWN_EXCEPTIONS, MagicMock):
        KNOWN_EXCEPTIONS = json.loads(KNOWN_EXCEPTIONS())  # pylint: disable=not-callable

    if actor_user(event) in KNOWN_EXCEPTIONS:
        return False
    user_agent = event.deep_get("properties", "userAgent", default="")
    error_code = event.deep_get("properties", "status", "errorCode", default=0)

    return all([user_agent in LEGACY_AUTH_USERAGENTS, error_code == 0])


def title(event):
    principal = actor_user(event)
    if principal is None:
        principal = "<NO_PRINCIPALNAME>"
    return f"AzureSignIn: Principal [{principal}] authenticated with a legacy auth protocol"


def dedup(event):
    principal = actor_user(event)
    if principal is None:
        principal = "<NO_PRINCIPALNAME>"
    return principal


def alert_context(event):
    a_c = azure_signin_alert_context(event)
    a_c["userAgent"] = event.deep_get("properties", "userAgent", "<NO_USERAGENT>")
    return a_c

Analyst notes

Based on Microsoft's analysis more than 97 percent of credential stuffing attacks use legacy authentication and more than 99 percent of password spray attacks use legacy authentication protocols. These attacks would stop with basic authentication disabled or blocked. see https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication If you are aware of this Legacy Auth need, and need to continue using this mechanism, add the principal name to KNOWN_EXCEPTIONS. The Reference link contains additional material hosted on Microsoft.com

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Medium
Status: Stable
Query type: python
Created: 2023-07-28
Modified: 2025-11-18
Authored by: panther-labs
Source ID
Upstream: rules/azure_signin_rules/azure_legacyauth.yml
Type: rule
Version: 1
References: https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/workbook-legacy-authentication
Data sources: Azure.Audit

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.