Sigma rule: Potential MFA Bypass Using Legacy Client Authentication

Rule

Title

Potential MFA Bypass Using Legacy Client Authentication

Status

test

Level

high

Author

Harjot Singh, '@cyb3rjy0t'

Date

2023-03-20

File

rules/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Log source

product

azure

service

signinlogs

Detection

selection:
    Status: 'Success'
    userAgent|contains:
        - 'BAV2ROPC'
        - 'CBAinPROD'
        - 'CBAinTAR'
condition: selection

False positives (as the rule lists them)

• Known Legacy Accounts

Tags

• attack.privilege-escalation
• attack.persistence
• attack.initial-access
• attack.credential-access
• attack.stealth
• attack.t1078.004
• attack.t1110

MITRE ATT&CK ids this rule names

• T1078.004
• T1110

References

• https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022
• https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml