Applications That Are Using ROPC Authentication Flow
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to…
What it detects
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider.
MITRE ATT&CK mapping
- T1078Valid Accounts· Defense Evasion
False positives and triage
Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/sigma/sigma.azure_signin_logs_azure_app_ropc_authentication.yaml, licensed under the Detection Rule License 1.1.
id: sigma.azure_signin_logs_azure_app_ropc_authentication
version: 1.0.0
status: experimental
severity: medium
confidence: 0.6
platforms:
- application
mitre_techniques:
- T1078
description: |
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.
The application then uses those credentials to authenticate the user against the identity provider.
match:
event_category: authentication
raw_message_any:
- ROPC
false_positive_guidance: Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow
Converted from the SigmaHQ rule “Applications That Are Using ROPC Authentication Flow” by Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik', distributed under the Detection Rule License 1.1. Original rule.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.