Attack Chain

1. An attacker gains initial access using compromised credentials (T1078).
2. The attacker attempts to authenticate to Entra ID.
3. Entra ID Identity Protection evaluates the sign-in attempt, factoring in elements such as source IP, geolocation, device details, and authentication method.
4. The sign-in is flagged as "high risk" by Identity Protection due to anomalous characteristics.
5. The sign-in logs record the high-risk level in the risk_level_during_signin property.
6. The detection rule triggers based on the high-risk sign-in event.
7. Post-authentication, the attacker potentially gains access to cloud resources and applications (T1078.004).
8. The attacker attempts lateral movement or data exfiltration.

Impact

A successful attack could lead to unauthorized access to sensitive data, resources, and applications within the organization's cloud environment. The number of affected users and the scope of the damage depend on the permissions and roles assigned to the compromised account. Organizations in any sector relying on Entra ID for authentication are potentially at risk. Failure to detect and remediate high-risk sign-ins can result in significant data breaches, financial losses, and reputational damage.

Recommendation

• Deploy the provided Sigma rule to your SIEM to detect high-risk Entra ID sign-ins based on the azure.signinlogs.properties.risk_level_during_signin and azure.signinlogs.properties.risk_level_aggregated fields.
• Investigate triggered alerts by reviewing the source.ip, source.geo.country_name, device_detail, and client_app_used fields in the Azure sign-in logs.
• If a compromise is suspected, immediately disable the user account and enforce a password reset with multi-factor authentication.
• Review and refine conditional access policies to enforce MFA for high-risk sign-ins and block legacy authentication protocols, referencing the information on conditional access policies in the references.