Azure Unusual Authentication Interruption

Title: Azure Unusual Authentication Interruption
Status: test
Description:Detects when there is a interruption in the authentication process.
References:
  -https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
Author: Austin Songer @austinsonger
Date: 2021-11-26
modified:2022-12-18
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.initial-access'
• -'attack.stealth'
• -'attack.t1078'

Logsource:

• product: azure
• service: signinlogs

Detection:
  selection_50097:
    ResultType: '50097'
    ResultDescription: 'Device authentication is required'
  selection_50155:
    ResultType: '50155'
    ResultDescription: 'DeviceAuthenticationFailed'
  selection_50158:
    ResultType: '50158'
    ResultDescription: 'ExternalSecurityChallenge - External security challenge was not satisfied'
  condition:1 of selection_*
Falsepositives:
  -Unknown
Level: medium