Legacy authentication: The curious case of BAV2ROPC

A mysterious user agent string in some Microsoft 365 audit logs offers clues for how to detect logins from legacy authentication protocols.

Legacy authentication: The curious case of BAV2ROPC Skip Navigation Get a Demo Products Managed Detection and Response AI Agents Threat Intelligence Automation Security Data Lake Managed Phishing Response Training & Tabletops What's New Plans Solutions By domain Identity Email Endpoint Cloud By technology Zscaler Microsoft CrowdStrike SentinelOne Palo Alto Networks AWS Google Linux & Kubernetes By Industry Financial Services Healthcare Technology Manufacturing Education Government Resources Blog Guides & Overviews Case Studies Videos Webinars Cybersecurity 101 Events Documentation Demo Video H

saved by

• Adithya V

related reading

• When MFA isn’t an option: The legacy of ROPC | Red Canaryredcanary.com
• Entra ID service principals in business email compromise schemes | Red Canaryredcanary.com
• Cloud coverage: Detecting an email payroll diversion attackredcanary.com
• Common Oauth Apps Used in Business Email Compromise - Syne's Cyber Cornercybercorner.tech
• Exposing and shutting down an inbox heist in actionredcanary.com
• Malicious Azure Application PERFECTDATA SOFTWARE and Microsoft 365 Business Email Compromise - Syne's Cyber Cornercybercorner.tech
• Email Compromise To Mass Phishing Campaigndarktrace.com
• The Soze Syndicate - Business Email Compromise Campaign | Todyltodyl.com
• Malicious Usage of eM Client In Business Email Compromise - Syne's Cyber Cornercybercorner.tech
• Mamba 2FA: A new contender in the AiTM phishing ecosystem - Sekoia.io Blogblog.sekoia.io
• PerfectData Software Abuse and Account Takeover Risksdarktrace.com
• Revoke user access in an emergency in Microsoft Entra ID - Microsoft Entra ID | Microsoft Learnlearn.microsoft.com