Microsoft Sentinel Analytic Rules
cloudbrothers.infoAzure Sentinel RepoToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeToggle Dark/Light/Auto modeBack to homepage

Azure secure score block legacy authentication

Back
IdC27BB559-28C5-4924-A7DA-3BF04CD02C8F
RulenameAzure secure score block legacy authentication
DescriptionThis query searches for most compromising sign-in attempts come from legacy authentication.

Older office clients such as Office 2010 do not support modern authentication

and use legacy protocols such as IMAP, SMTP, and POP3.

Legacy authentication does not support multi-factor authentication (MFA).

Even if an MFA policy is configured in your environment, bad actors can

bypass these enforcements through legacy protocols.
SeverityHigh
TacticsCredentialAccess
TechniquesT1212
T1556
Required data connectorsSenservaPro
KindScheduled
Query frequency6h
Query period6h
Trigger threshold0
Trigger operatorgt
Source Urihttps://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/BlockLegacyAuthentication.yaml
Version1.0.0
Arm templateC27BB559-28C5-4924-A7DA-3BF04CD02C8F.json
Deploy To Azure
SenservaPro_CL
| where ControlName_s == 'AzureSecureScoreBlockLegacyAuthentication'
queryFrequency: 6h
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: ControlName_s
    identifier: Name
  - columnName: TenantId
    identifier: AadTenantId
  - columnName: TenantDisplayName_s
    identifier: DisplayName
- entityType: SecurityGroup
  fieldMappings:
  - columnName: Group_s
    identifier: DistinguishedName
- entityType: AzureResource
  fieldMappings:
  - columnName: SourceSystem
    identifier: ResourceId
severity: High
triggerThreshold: 0
relevantTechniques:
- T1212
- T1556
query: |
  SenservaPro_CL
  | where ControlName_s == 'AzureSecureScoreBlockLegacyAuthentication'  
id: C27BB559-28C5-4924-A7DA-3BF04CD02C8F
triggerOperator: gt
version: 1.0.0
requiredDataConnectors:
- connectorId: SenservaPro
  dataTypes:
  - SenservaPro_CL
description: |
  'This query searches for most compromising sign-in attempts come from legacy authentication. 
   Older office clients such as Office 2010 do not support modern authentication 
   and use legacy protocols such as IMAP, SMTP, and POP3. 
   Legacy authentication does not support multi-factor authentication (MFA).
   Even if an MFA policy is configured in your environment, bad actors can 
   bypass these enforcements through legacy protocols.'  
queryPeriod: 6h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/BlockLegacyAuthentication.yaml
status: Available
name: Azure secure score block legacy authentication
tactics:
- CredentialAccess
kind: Scheduled
{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/C27BB559-28C5-4924-A7DA-3BF04CD02C8F')]",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/C27BB559-28C5-4924-A7DA-3BF04CD02C8F')]",
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
      "kind": "Scheduled",
      "apiVersion": "2022-11-01",
      "properties": {
        "displayName": "Azure secure score block legacy authentication",
        "description": "'This query searches for most compromising sign-in attempts come from legacy authentication. \n Older office clients such as Office 2010 do not support modern authentication \n and use legacy protocols such as IMAP, SMTP, and POP3. \n Legacy authentication does not support multi-factor authentication (MFA).\n Even if an MFA policy is configured in your environment, bad actors can \n bypass these enforcements through legacy protocols.'\n",
        "severity": "High",
        "enabled": true,
        "query": "SenservaPro_CL\n| where ControlName_s == 'AzureSecureScoreBlockLegacyAuthentication'\n",
        "queryFrequency": "PT6H",
        "queryPeriod": "PT6H",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess"
        ],
        "techniques": [
          "T1212",
          "T1556"
        ],
        "alertRuleTemplateName": "C27BB559-28C5-4924-A7DA-3BF04CD02C8F",
        "customDetails": null,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "identifier": "Name",
                "columnName": "ControlName_s"
              },
              {
                "identifier": "AadTenantId",
                "columnName": "TenantId"
              },
              {
                "identifier": "DisplayName",
                "columnName": "TenantDisplayName_s"
              }
            ]
          },
          {
            "entityType": "SecurityGroup",
            "fieldMappings": [
              {
                "identifier": "DistinguishedName",
                "columnName": "Group_s"
              }
            ]
          },
          {
            "entityType": "AzureResource",
            "fieldMappings": [
              {
                "identifier": "ResourceId",
                "columnName": "SourceSystem"
              }
            ]
          }
        ],
        "status": "Available",
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SenservaPro/Analytic Rules/BlockLegacyAuthentication.yaml",
        "templateVersion": "1.0.0"
      }
    }
  ]
}