Applications That Are Using ROPC Authentication Flow — Sigma Rule

Rule metadata and linked tags

Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'. Source status: test; severity: medium. Source dates: 2022-06-01 / not supplied.

{
  "product": "azure",
  "service": "signinlogs"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: dc4ba50a79b843390a8e218b23cbe8e87ec70595d2bd23c0167469737c0c4e78

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Applications That Are Using ROPC Authentication Flow
id: 55695bc0-c8cf-461f-a379-2535f563c854
status: test
description: |
    Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.
    The application then uses those credentials to authenticate the user against the identity provider.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
date: 2022-06-01
tags:
    - attack.stealth
    - attack.t1078
    - attack.persistence
    - attack.privilege-escalation
    - attack.initial-access
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        properties.message: ROPC
    condition: selection
falsepositives:
    - Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow
level: medium

Original YAML and metadata in JSON

False positives

• Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow

Source references

• https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows