LoFP LoFP / legitimate broker sign-ins to first-party microsoft resources that use alternate well-known ids, regional variants, or new microsoft services not yet in the exclusion list may match. third-party applications that integrate with mab for delegated authentication can also appear. baseline `resource_id` and `resource_display_name` for your environment and add exclusions for approved resources.

Techniques

Sample rules

Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource

Description

Detects successful Microsoft Entra ID sign-ins where the client application is the Microsoft Authentication Broker (MAB) and the requested resource identifier is outside a short list of commonly observed first-party targets. Attackers abuse the broker in phishing and token broker flows to obtain tokens for unexpected APIs or enterprise applications. The exclusion list covers legacy Azure Active Directory, Microsoft Graph, Device Registration Service, Microsoft Intune Enrollment, extend or tune exclusions for your tenant after baselining broker traffic.

Detection logic

data_stream.dataset:"azure.signinlogs" and event.category:"authentication" and event.action:"Sign-in activity" and
event.outcome:success and azure.signinlogs.properties.app_id:"29d9ed98-a469-4536-ade2-f981bc1d605e" and
azure.signinlogs.properties.resource_id:(* and not 
    ("00000002-0000-0000-c000-000000000000" or
    "90a2e5d2-fd7a-4a2e-bc90-3dc50ae8e3ee" or
    "01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9" or
    "d4ebce55-015a-49b5-a083-c84d1797ae8c" or
    "00000003-0000-0000-c000-000000000000" or 
    "0a5f63c0-b750-4f38-a71c-4fc0d58b89e2")
)