Entra legacy auth sign-in
A successful Entra ID sign-in over a legacy / basic-authentication client (IMAP4, POP3, SMTP, MAPI, Exchange ActiveSync, "Other clients").
What it detects
A successful Entra ID sign-in over a legacy / basic-authentication client (IMAP4, POP3, SMTP, MAPI, Exchange ActiveSync, "Other clients"). Legacy auth bypasses modern authentication and, in most tenants, MFA — a common path for valid-account abuse and a signal to review even when the sign-in "succeeds".
MITRE ATT&CK mapping
- T1078.004Valid Accounts: Cloud Accounts· Initial Access
False positives and triage
Some legitimate line-of-business apps still use legacy protocols. Allowlist known service accounts / apps, then treat any remaining legacy-auth success as suspect — especially from a new IP or country, or right after failed modern-auth attempts.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/entra_legacy_auth_signin.yaml, licensed under the Apache License 2.0.
id: cloud.identity.entra_legacy_auth_signin
version: 1.0.0
status: stable
severity: medium
confidence: 0.7
platforms: [application]
mitre_techniques: [T1078.004]
description: |
A successful Entra ID sign-in over a legacy / basic-authentication client
(IMAP4, POP3, SMTP, MAPI, Exchange ActiveSync, "Other clients"). Legacy auth
bypasses modern authentication and, in most tenants, MFA — a common path for
valid-account abuse and a signal to review even when the sign-in "succeeds".
match:
event_category: authentication
event_outcome: success
provider: AzureAD
raw_message_contains_any:
- "client=IMAP4"
- "client=POP3"
- "client=SMTP"
- "client=Authenticated SMTP"
- "client=Exchange ActiveSync"
- "client=Other clients"
- "client=MAPI"
- "client=Older Office clients"
false_positive_guidance: |
Some legitimate line-of-business apps still use legacy protocols. Allowlist known
service accounts / apps, then treat any remaining legacy-auth success as suspect
— especially from a new IP or country, or right after failed modern-auth attempts.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.