Elastic medium stable kql

M365 Identity OAuth ROPC Grant via Legacy Authentication Client

Identifies a successful login by a user principal through a legacy authenticated client (such as Authenticated SMTP, IMAP, POP, or Exchange ActiveSync) in the Microsoft 365 Unified Audit Log, evidenced by the "BAV2ROPC" user agent. Legacy basic-authentication clients are translated by Entra ID into a Resource Owner Password Credentials (ROPC) grant, a single-factor flow that submits the user's password directly and bypasses interactive multi-factor authentication. This is commonly abused during password spraying and account takeover.

View Source

Detection Logic

data_stream.dataset: "o365.audit" and
    event.code: "AzureActiveDirectoryStsLogon" and
    event.action: "UserLoggedIn" and
    user_agent.original: "BAV2ROPC" and
    event.outcome: "success"

Field Validations

Loading…

Comments (0)

Loading comments...