Merge pull request #3898 from cyb3rjy0t/patch-2

New rule
2023-01-10 20:47:48 +01:00
parent cb21d5d23e 8e7187e861
commit 0c3ba418db
1 changed files with 24 additions and 0 deletions
@@ -0,0 +1,24 @@
+title: Suspicious SignIns From A Non Registered Device
+id: 572b12d4-9062-11ed-a1eb-0242ac120002
+status: experimental
+description: Detects risky authencaition from a non AD registered device without MFA being required.
+references:
+    - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in
+author: Harjot Singh, '@cyb3rjy0t'
+date: 2023/01/10
+tags:
+    - attack.defense_evasion
+    - attack.t1078
+logsource:
+    product: azure
+    service: signinlogs
+detection:
+    selection:
+        Status: 'Success'
+        AuthenticationRequirement: 'singleFactorAuthentication'
+        DeviceDetail.trusttype: ''
+        RiskState: 'atRisk'
+    condition: selection
+falsepositives:
+    - Unknown
+level: high