Sigma rule: Applications That Are Using ROPC Authentication Flow

Rule

Title

Applications That Are Using ROPC Authentication Flow

Status

test

Level

medium

Author

Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'

Date

2022-06-01

File

rules/cloud/azure/signin_logs/azure_app_ropc_authentication.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.
The application then uses those credentials to authenticate the user against the identity provider.

Log source

product

azure

service

signinlogs

Detection

selection:
    properties.message: ROPC
condition: selection

False positives (as the rule lists them)

• Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow

Tags

• attack.stealth
• attack.t1078
• attack.persistence
• attack.privilege-escalation
• attack.initial-access

MITRE ATT&CK ids this rule names

• T1078

References

• https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/azure/signin_logs/azure_app_ropc_authentication.yml