Sign-in user agent rotation
One account signing in behind MANY DIFFERENT client strings in a short window.
What it detects
One account signing in behind MANY DIFFERENT client strings in a short window.
A person has a device or two. Their sign-ins carry a stable handful of user agents, and that stays true across a working day. Five distinct client platforms for one account inside an hour — Windows Phone, Ubuntu i686, an Android build, macOS — is not a person with many devices; it is one script rotating its User-Agent header, which enumeration and MFA-sweep tooling does by default to look like organic traffic.
Deliberately counts DISTINCT client strings rather than sign-in volume: the tooling is quiet by design, so the count of attempts stays low and only the variety gives it away. This is the sign-in-shaped version of the catalog's "rare user-agent for a user" primitive.
MITRE ATT&CK mapping
False positives and triage
Genuine multi-device users exist — a phone, a laptop, a tablet and a browser that updated its agent mid-window can approach the threshold — and a shared or service account legitimately fronts many clients, which is the main benign source. Look at whether the agents are PLAUSIBLE TOGETHER: one person's devices are a coherent set, while a rotation mixes mobile and desktop platforms that no single user owns, and often includes stale browser versions no current device ships. Shared mailboxes and automation accounts should be allowlisted once confirmed rather than tuned around.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 55%. Source: rules/cloud/signin_user_agent_rotation.yaml, licensed under the Apache License 2.0.
id: cloud.identity.signin_user_agent_rotation
version: 1.0.0
status: stable
severity: medium
confidence: 0.55
platforms: [application]
mitre_techniques: [T1592.004, T1078]
description: |
One account signing in behind MANY DIFFERENT client strings in a short window.
A person has a device or two. Their sign-ins carry a stable handful of user
agents, and that stays true across a working day. Five distinct client platforms
for one account inside an hour — Windows Phone, Ubuntu i686, an Android build,
macOS — is not a person with many devices; it is one script rotating its
User-Agent header, which enumeration and MFA-sweep tooling does by default to
look like organic traffic.
Deliberately counts DISTINCT client strings rather than sign-in volume: the
tooling is quiet by design, so the count of attempts stays low and only the
variety gives it away. This is the sign-in-shaped version of the catalog's
"rare user-agent for a user" primitive.
match:
event_category: authentication
threshold:
count: 5
window_seconds: 3600
distinct: user_agent
group_by: [user_name]
correlation_keys: [user_name]
false_positive_guidance: |
Genuine multi-device users exist — a phone, a laptop, a tablet and a browser that
updated its agent mid-window can approach the threshold — and a shared or
service account legitimately fronts many clients, which is the main benign
source. Look at whether the agents are PLAUSIBLE TOGETHER: one person's devices
are a coherent set, while a rotation mixes mobile and desktop platforms that no
single user owns, and often includes stale browser versions no current device
ships. Shared mailboxes and automation accounts should be allowlisted once
confirmed rather than tuned around.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.