ALT-2410 · Entra ID
Legacy authentication protocol usage spike
IMAP4 authentication attempts increased 8x versus the weekly baseline.
lowFalse Positiveconfidence 68% · 1970-01-01 00:59:00Z · rule DET-0091 Legacy Auth Usage
Detection summary
IMAP4 authentication attempts increased 8x versus the weekly baseline.
- Affected host
- WS-FIN-014
- Affected user
- m.tanaka
- Source IP
- 10.20.19.91
- Detection rule
- DET-0091 Legacy Auth Usage
- Log source
- Entra ID
- Assignee
- D. Kusuma
Recommended actions
- Confirm whether a legacy client was deployed
- Plan legacy auth blocking
Analyst decision
Triage checklist
- 1. Confirm the detection logic matched genuine activity.
- 2. Check user and asset context for expected behaviour.
- 3. Pivot on host, user, IP and hash in the Log Explorer.
- 4. Enrich IOCs with threat intelligence.
- 5. Set a verdict and record your reasoning.