« Entra ID Protection User Alert and Device Registration Entra ID Register Device with Unusual User Agent (Azure AD Join) »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

Entra ID ROPC Authentication with Unknown Client ID

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Entra ID ROPC Authentication with Unknown Client ID

edit

Identifies potential OAuth client ID spoofing in Microsoft Entra ID sign-in logs. Adversaries submit fabricated or non-existent application identifiers (client IDs) in Resource Owner Password Credentials (ROPC) authentication requests to the token endpoint. Because Entra ID validates the submitted credential before rejecting the request on application resolution, the resulting error code acts as a credential- and account-validity oracle while never producing a successful sign-in. By fragmenting attempts across many fictional application identifiers, adversaries evade per-application detections, rate limiting, and application-scoped Conditional Access. This rule detects a ROPC authentication that fails with error code 700016 (application not found in the directory) where no application display name resolves, which is characteristic of a spoofed client ID used for stealthy user enumeration and password spraying.

Rule type: new_terms

Rule indices:

  • logs-azure.signinlogs-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Domain: Identity
  • Data Source: Azure
  • Data Source: Entra ID
  • Data Source: Entra ID Sign-in Logs
  • Use Case: Identity and Access Audit
  • Use Case: Threat Detection
  • Tactic: Credential Access
  • Tactic: Discovery
  • Resources: Investigation Guide

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Entra ID ROPC Authentication with Unknown Client ID

Adversaries submit fabricated application identifiers (client IDs) in ROPC authentication requests to Microsoft’s token endpoint. Entra ID validates the supplied username and password before rejecting the request because the application does not exist, so the returned error code reveals whether the credential and account are valid without ever producing a successful sign-in. A valid credential paired with a spoofed client ID returns AADSTS700016 (application not found), an invalid password returns AADSTS50126, and a non-existent user returns AADSTS50034. Because the application never resolves, application-scoped Conditional Access is bypassed, and fragmenting requests across many random client IDs defeats per-application correlation and rate limiting. This behavior is used for stealthy user enumeration and password spraying (for example, the campaigns Proofpoint tracks as UNK_pyreq2323 and UNK_OutFlareAZ).

This rule detects a ROPC authentication (authentication_protocol: ropc) that fails with status.error_code: 700016 and carries no resolved app_display_name, the signature of a spoofed or non-existent client ID. This is a New Terms rule that triggers only when the application identifier (app_id) has not been observed in the tenant’s sign-in logs in the previous 10 days, so each newly introduced spoofed client ID surfaces once rather than on every attempt.

Possible investigation steps

  • Review azure.signinlogs.properties.app_id: the value is a client ID that does not resolve to any registered application in the tenant. Determine whether the same principal or source is presenting many distinct or randomized client IDs (fragmentation) versus a single stable identifier (possible deleted app).
  • Assess azure.signinlogs.properties.user_principal_name: a valid user account produces a sign-in log for this activity, so the targeted principal exists in the directory and its credentials are being probed. Prioritize privileged or high-value accounts.
  • Correlate azure.signinlogs.properties.status.error_code for the same user and source over time. A shift from 50126 (invalid password) to 700016 (application not found) for the same account indicates the adversary has confirmed a valid credential, because the request advanced past credential validation.
  • Review source.ip, source.as.organization.name, and source.geo.country_name: enumeration commonly originates from hosting providers, VPNs, or proxy infrastructure rather than corporate ranges.
  • Inspect user_agent.original and azure.signinlogs.properties.client_app_used: scripted enumeration frequently uses generic HTTP libraries and logs client_app_used as Unknown.
  • Pivot on the source IP or ASN to determine how many distinct user principals are being probed, which distinguishes targeted probing from broad spraying.

False positive analysis

  • A legitimate application deleted from the tenant while a client keeps authenticating against its former client ID via ROPC can produce 700016. Such activity is typically a single, stable client ID at low volume, unlike the many distinct or randomized identifiers seen in spoofing.
  • A misconfigured legacy client submitting an incorrect client ID may also trigger this rule. Confirm the client ID, the source, and whether the same principal is targeted by multiple unresolved client IDs before dismissing.

Response and remediation

  • If enumeration is confirmed, treat the targeted accounts as credential-probing targets: force password resets and revoke refresh tokens for any account where the error code progressed to 700016 (credential likely validated).
  • Block the offending source IPs or ASNs at the firewall, proxy, or via Conditional Access named locations.
  • Ensure MFA and Conditional Access are enforced for all user types, and disable legacy and ROPC authentication where not required, since ROPC cannot satisfy MFA.
  • Audit targeted accounts for credential reuse across services and monitor for follow-on interactive or non-interactive sign-in success from the same source.
  • Notify your identity security team and correlate with any concurrent brute-force or password-spray detections.

Rule query

edit
data_stream.dataset: "azure.signinlogs"
    and event.category: "authentication"
    and azure.signinlogs.properties.authentication_protocol: "ropc"
    and azure.signinlogs.properties.status.error_code: 700016
    and not azure.signinlogs.properties.app_display_name: *

Framework: MITRE ATT&CKTM

« Entra ID Protection User Alert and Device Registration Entra ID Register Device with Unusual User Agent (Azure AD Join) »