Title:Authentications To Important Apps Using Single Factor Authentication Status:test Description:Detect when authentications to important application(s) only required single-factor authentication References: -https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts Author: MikeDuddington, '@dudders1' Date: 2022-07-28 modified:None Tags:
-'attack.privilege-escalation'
-'attack.persistence'
-'attack.initial-access'
-'attack.stealth'
-'attack.t1078'
Logsource:
product: azure
service: signinlogs
Detection: selection: Status:
'Success' AppId:
'Insert Application ID use OR for multiple' AuthenticationRequirement:
'singleFactorAuthentication' condition:selection Falsepositives:
-If this was approved by System Administrator. Level:medium
