Skip to content
Threat Feed
Subscribe
medium advisory

Detection of Anomalous Entra ID Authentication Methods

Adversaries may use stolen credentials with unusual authentication methods to bypass Conditional Access Policies and MFA in Microsoft Entra ID environments.

This detection brief addresses the risk of adversaries leveraging stolen credentials to authenticate to Microsoft Entra ID using non-standard or previously unseen authentication methods. By utilizing authentication flows that diverge from a user's historical baseline, attackers attempt to bypass Conditional Access Policies (CAP) and multi-factor authentication (MFA) requirements.

This technique is significant for defenders because it targets the gap between standard user behavior and the configuration of authentication requirements. The detection focuses on successful sign-in events where the authentication method has not been recorded for a specific user within the previous 14 days, particularly in environments where MFA was not triggered. Organizations should investigate these events to distinguish between legitimate user onboarding or policy changes and malicious attempts to circumvent identity security controls.

Impact

Successful exploitation of this technique allows adversaries to establish unauthorized access to cloud resources using valid identities. This bypasses security mechanisms intended to verify user identity, potentially leading to unauthorized data exfiltration, persistent access, and compromise of sensitive cloud assets. The scale of impact is dependent on the privileges assigned to the compromised account and the effectiveness of secondary monitoring controls.

Recommendation

  • Deploy the provided detection logic to identify the first occurrence of unusual authentication methods for Entra ID users.
  • Investigate alerts by verifying the source.ip against known malicious infrastructure and reviewing the user's recent sign-in history.
  • Verify if the authentication protocol recorded in azure.signinlogs.properties.authentication_protocol aligns with expected business applications.
  • Ensure MFA is enforced via Conditional Access Policies for all users, particularly those with high-privileged roles.
  • Restrict the use of legacy authentication protocols that do not support modern MFA requirements.

Immediate actions

Deploy new terms detection for Entra ID authentication methods.

Detection Engineering 72h

Threat Hunt

Search for rare authentication methods in sign-in logs over the last 30 days.

T1078.004 medium medium confidence convert to detection

Data: Azure Sign-in Logs

Detection coverage 1

Entra ID User Sign-in with Unusual Authentication Type

medium

Identifies rare authentication methods used by Entra ID members that bypass MFA, potentially indicating credential abuse.

sigma tactics: defense_evasion, initial_access techniques: T1078.004 sources: webserver

Detection queries are available on the platform. Get full rules →