{"id":"55695bc0-c8cf-461f-a379-2535f563c854","title":"Applications That Are Using ROPC Authentication Flow","description":"Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.\nThe application then uses those credentials to authenticate the user against the identity provider.\n","author":"Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'","status":"test","level":"medium","date":"2022-06-01","modified":"","tags":["attack.stealth","attack.t1078","attack.persistence","attack.privilege-escalation","attack.initial-access"],"technique_ids":["T1078"],"logsource":{"product":"azure","service":"signinlogs"},"falsepositives":["Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow"],"references":["https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows"],"source_path":"rules/cloud/azure/signin_logs/azure_app_ropc_authentication.yml","source_sha256":"dc4ba50a79b843390a8e218b23cbe8e87ec70595d2bd23c0167469737c0c4e78","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/signin_logs/azure_app_ropc_authentication.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Applications That Are Using ROPC Authentication Flow\nid: 55695bc0-c8cf-461f-a379-2535f563c854\nstatus: test\ndescription: |\n    Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.\n    The application then uses those credentials to authenticate the user against the identity provider.\nreferences:\n    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows\nauthor: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'\ndate: 2022-06-01\ntags:\n    - attack.stealth\n    - attack.t1078\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.initial-access\nlogsource:\n    product: azure\n    service: signinlogs\ndetection:\n    selection:\n        properties.message: ROPC\n    condition: selection\nfalsepositives:\n    - Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"}],"data_path":"data/detection-rules/55695bc0-c8cf-461f-a379-2535f563c854.json","kind":"sigma"}