Elastic medium stable kql
Entra ID User Sign-in with Unusual Client
Detects rare non-interactive sign-ins where an Entra ID client application authenticates on behalf of a principal user using an application (client) ID that is not commonly associated with that user's historical sign-in behavior. Adversaries with stolen credentials or OAuth tokens may abuse Entra ID–managed or first-party client IDs to perform on-behalf-of (OBO) authentication, blending into legitimate cloud traffic while avoiding traditional interactive sign-in flows. This technique is commonly observed in OAuth phishing, token theft, and access broker operations, and may precede lateral movement, persistence, or data access via Microsoft Graph or other cloud resources. The rule uses a New Terms approach to identify first-seen combinations of the UPN and Client ID within a defined history window, helping surface unexpected client usage that may indicate compromised identities, malicious automation, or unauthorized application impersonation.
Detection Logic
data_stream.dataset: "azure.signinlogs" and event.category: "authentication"
and azure.signinlogs.properties.is_interactive: false
and azure.signinlogs.properties.user_type: "Member"
and not azure.signinlogs.properties.client_app_used: "Browser"
and not source.as.organization.name: "MICROSOFT-CORP-MSN-AS-BLOCK"
and not azure.signinlogs.properties.app_id: (
"1b3c667f-cde3-4090-b60b-3d2abd0117f0" or
"26a7ee05-5602-4d76-a7ba-eae8b7b67941" or
"4b0964e4-58f1-47f4-a552-e2e1fc56dcd7" or
"ecd6b820-32c2-49b6-98a6-444530e5a77a" or
"268761a2-03f3-40df-8a8b-c3db24145b6b" or
"fc0f3af4-6835-4174-b806-f7db311fd2f3" or
"de50c81f-5f80-4771-b66b-cebd28ccdfc1" or
"ab9b8c07-8f02-4f72-87fa-80105867a763" or
"6f7e0f60-9401-4f5b-98e2-cf15bd5fd5e3" or
"d7b530a4-7680-4c23-a8bf-c52c121d2e87" or
"52c2e0b5-c7b6-4d11-a89c-21e42bcec444" or
"38aa3b87-a06d-4817-b275-7a316988d93b" or
"27922004-5251-4030-b22d-91ecd9a37ea4" or
"9ba1a5c7-f17a-4de9-a1f1-6178c8d51223" or
"cab96880-db5b-4e15-90a7-f3f1d62ffe39" or
"3a4d129e-7f50-4e0d-a7fd-033add0a29f4" or
"29d9ed98-a469-4536-ade2-f981bc1d605e" or
"c0ab8ce9-e9a0-42e7-b064-33d422df41f1" or
"9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7" or
"4813382a-8fa7-425e-ab75-3b753aab3abb" or
"08e18876-6177-487e-b8b5-cf950c1e598c" or
"0ec893e0-5785-4de6-99da-4ed124e5296c" or
"d3590ed6-52b3-4102-aeff-aad2292ab01c" or
"0dc2408a-bbc0-4238-871e-13b372f0200f" or
"af124e86-4e96-495a-b70a-90f90ab96707" or
"e9c51622-460d-4d3d-952d-966a5b1da34c" or
"f44b1140-bc5e-48c6-8dc0-5cf5a53c0e34" or
"e2ef5054-0287-4db6-afa3-013d96881fd3" or
"82864fa0-ed49-4711-8395-a0e6003dca1f" or
"60c8bde5-3167-4f92-8fdb-059f6176dc0f" or
"5d661950-3475-41cd-a2c3-d671a3162bc1" or
"145fc680-eb72-4bcf-b4d5-8277021a1ce8" or
"c1c74fed-04c9-4704-80dc-9f79a2e515cb" or
"a2760c41-63c9-42b5-8d58-bfa1fd9e2eb3" or
"6dec647e-42c4-45a6-8f13-e8250d34e033" or
"c98e5057-edde-4666-b301-186a01b4dc58" or
"0a31c71e-0abf-4238-add7-b1a24c165dc1" or
"a8759234-4b8b-4d94-8c0a-ee1ab73af270" or
"dae89220-69ba-4957-a77a-47b78695e883" or
"fd5f78f6-a28f-450b-abc7-777f3dbbfcba" or
"821caec6-bec3-4542-bead-d3c5fb6b4ef0" or
"a40d7d7d-59aa-447e-a655-679a4107e548" or
"bed12bc0-3a62-470d-998c-e47546e7b039" or
"f4060917-6abe-40d7-baa6-f634c0eda4ac" or
"b26aadf8-566f-4478-926f-589f601d9c74" or
"1f7f6f43-2f81-429c-8499-293566d0ab0c" or
"75f31797-37c9-498e-8dc9-53c16a36afca" or
"3e050dd7-7815-46a0-8263-b73168a42c10" or
"243c63a3-247d-41c5-9d83-7788c43f1c43" or
"75efb5bc-18a1-4e7b-8a66-2ad2503d79c6" or
"d32f3b53-b7d7-48df-8d0f-f8bf233b3f1f" or
"95de633a-083e-42f5-b444-a4295d8e9314" or
"3ff8e6ba-7dc3-4e9e-ba40-ee12b60d6d48" or
"871c010f-5e61-4fb1-83ac-98610a7e9110" or
"3e62f81e-590b-425b-9531-cad6683656cf" or
"8ec6bc83-69c8-4392-8f08-b3c986009232" or
"d326c1ce-6cc6-4de2-bebc-4591e5e13ef0" or
"dd762716-544d-4aeb-a526-687b73838a22" or
"7f8f922d-7ee4-40a6-b435-aad8b84ebde0" or
"f8d98a96-0999-43f5-8af3-69971c7bb423" or
"aa580612-c342-4ace-9055-8edee43ccb89" or
"7f67af8a-fedc-4b08-8b4e-37c4d127b6cf" or
"00bf137d-f689-4c5d-83d9-7fc31904a7ea" or
"ceb96695-e468-48ba-ba21-35e2a242d396" or
"7fba38f4-ec1f-458d-906c-f4e3c4f41335" or
"a2a1fecc-b06e-4a1e-95c1-2afd94bcadff" or
"15ddab63-ba81-45db-9bb6-6f8bc445c459" or
"bc59ab01-8403-45c6-8796-ac3ef710b3e3" or
"00000003-0000-0ff1-ce00-000000000000" or
"4e291c71-d680-4d0e-9640-0a3358e31177" or
"4fb5cc57-dbbc-4cdc-9595-748adff5f414" or
"22098786-6e16-43cc-a27d-191a01a1e3b5" or
"ebde7daf-df42-4ade-81a4-d67b339b49e9" or
"c0d2a505-13b8-4ae0-aa9e-cddd5eab0b12" or
"a672d62c-fc7b-4e81-a576-e60dc46e951d" or
"0b1df6d3-2deb-44d4-b44b-7101937e0726" or
"04f0c124-f2bc-4f59-8241-bf6df9866bbd" or
"86f4c005-6582-4559-b6cf-8b3111236736" or
"a0a3c1d3-7b82-4010-bdb0-e7048fb8f1fe" or
"a187e399-0c36-4b98-8f04-1edc167a0996" or
"2d4d3d8e-2be3-4bef-9f87-7875a61c29de" or
"c475db56-f463-48d8-931a-cfa7cd642289" or
"71a7c376-13e6-4100-968e-92ce98c5d3d2"
)
and not (
azure.signinlogs.properties.app_id: "1fec8e78-bce4-4aaf-ab1b-5451cc387264" and
azure.signinlogs.properties.resource_id: (
"cc15fd57-2c6c-4117-a88c-83b1d56b4bbe" or
"39aaf054-81a5-48c7-a4f8-0293012095b9" or
"b1379a75-ce5e-4fa3-80c6-89bb39bf646c" or
"6bc3b958-689b-49f5-9006-36d165f30e00"
)
)
and not (
azure.signinlogs.properties.app_id: "4765445b-32c6-49b0-83e6-1d93765276ca" and
azure.signinlogs.properties.resource_id: "4765445b-32c6-49b0-83e6-1d93765276ca" and
azure.signinlogs.properties.authentication_processing_details: *M365Copilot.Read.All* and
azure.signinlogs.properties.incoming_token_type: "primaryRefreshToken" and
azure.signinlogs.properties.client_app_used: "Mobile Apps and Desktop clients" and
azure.signinlogs.properties.device_detail.is_managed: true and
azure.signinlogs.properties.device_detail.operating_system: "Windows10" and
user_agent.original: Mozilla*Edge/18.*
)Field Validations
Loading…
Comments (0)
Loading comments...