Omar Zayed
@OmarZayed0 followers5 downloads15 copies0 likes333 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
This detection identifies single-factor ROPC (Resource Owner Password Credentials) logins from new countries not seen in the last 14 days for a given user+app combination. ROPC authentication does not support MFA, making it a frequent vector for attackers to bypass MFA misconfigurations and gain initial access or escalate privileges in Azure AD.
