Hunting For Malicious Login Attempts Based On Basic Authentication
Query
AADSignInEventsBeta
| where UserAgent has "BAV2ROPC" or UserAgent has "AConsumerV2ROPC"
| where AuthenticationRequirement has "singleFactorAuthentication"
| distinct Application, EndpointCall, ErrorCode, AuthenticationRequirement, UserAgent, ClientAppUsed, IPAddress , CountryAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1078.004 | Valid Accounts: Cloud Accounts |
Author: Sergio Albea (11/02/2025)
Hunting for malicious login attempts based on basic authentication
Description: This KQL Query helps to detect Basic authentication sign-in attempts using specific agents which are identified as risky and used by malicious actors. The ROPC flow is considered insecure because it requires applications to handle user credentials directly, increasing the risk of credential theft. Microsoft discourages the use of ROPC and Basic Authentication in favor of more secure, modern authentication methods such as OAuth 2.0 with MFA and token-based authentication.
Explanation
This KQL (Kusto Query Language) query is designed to help identify potentially malicious login attempts in a cloud environment. It focuses on detecting sign-in attempts that use basic authentication methods, which are considered less secure. Here's a simple breakdown of what the query does:
-
Data Source: The query looks at data from
AADSignInEventsBeta, which contains sign-in event logs for Azure Active Directory. -
Filter Criteria:
- It searches for sign-in attempts where the
UserAgentstring includes "BAV2ROPC" or "AConsumerV2ROPC". These are specific identifiers for agents known to be risky and potentially used by malicious actors. - It further filters these attempts to those that require only "singleFactorAuthentication", which is less secure compared to multi-factor authentication.
- It searches for sign-in attempts where the
-
Output:
- The query returns a distinct list of several attributes related to these sign-in attempts, including the application used, endpoint call, error code, authentication requirement, user agent, client application used, IP address, and country.
Overall, the query aims to highlight login attempts that might be insecure or indicative of unauthorized access attempts, encouraging the use of more secure authentication methods like OAuth 2.0 with multi-factor authentication (MFA).
