Techniques
Sample rules
Use of Legacy Authentication Protocols
- source: sigma
- technicques:
- t1078
- t1078.004
- t1110
Description
Alert on when legacy authentication has been used on an account
Detection logic
condition: selection
selection:
ActivityDetails: Sign-ins
ClientApp:
- Other client
- IMAP
- POP3
- MAPI
- SMTP
- Exchange ActiveSync
- Exchange Web Services
Username: UPN