Sign-in success
A successful cloud identity sign-in (Entra ID / Azure AD, Exchange Online, and other application-platform authentication sources).
What it detects
A successful cloud identity sign-in (Entra ID / Azure AD, Exchange Online, and other application-platform authentication sources). Matches on the SIGNAL — an application-platform authentication success — rather than one provider label, so it fires across cloud sources (Graph signIns "sign_in", Unified Audit "UserLoggedIn", …). Routine and low-signal on its own; surfaced so the correlation engine can pair it with a preceding cloud brute-force burst from the same source and user, indicating a sign-in that likely SUCCEEDED. Never an incident by itself.
MITRE ATT&CK mapping
- T1078Valid Accounts· Defense Evasion
False positives and triage
Almost all successful sign-ins are legitimate; this rule is deliberately low severity and confidence. It becomes noteworthy only when it directly follows a cloud brute-force / password-spray burst against the same account from the same source IP. Judge alongside the sign-in error history and source reputation.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 10%. Source: rules/cloud/signin_success.yaml, licensed under the Apache License 2.0.
id: cloud.identity.signin_success
version: 1.1.0
status: stable
severity: low
confidence: 0.1
platforms: [application]
role: context
mitre_techniques: [T1078]
description: |
A successful cloud identity sign-in (Entra ID / Azure AD, Exchange Online, and
other application-platform authentication sources). Matches on the SIGNAL — an
application-platform authentication success — rather than one provider label, so
it fires across cloud sources (Graph signIns "sign_in", Unified Audit
"UserLoggedIn", …). Routine and low-signal on its own; surfaced so the
correlation engine can pair it with a preceding cloud brute-force burst from the
same source and user, indicating a sign-in that likely SUCCEEDED. Never an
incident by itself.
match:
platform: application
event_category: authentication
event_outcome: success
correlation_keys: [source_ip:user_name]
false_positive_guidance: |
Almost all successful sign-ins are legitimate; this rule is deliberately low
severity and confidence. It becomes noteworthy only when it directly follows a
cloud brute-force / password-spray burst against the same account from the same
source IP. Judge alongside the sign-in error history and source reputation.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.