m365:unified UserLoggedIn
UserLoggedIn
- Log source
- Microsoft 365 Unified Audit Log
- Host type
- Microsoft 365
- Tier, host type
- Minimum
- Techniques
- 2
- Rules depending on it
- Splunk 2, Elastic 5
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Microsoft 365 tenant | Minimum |
Techniques it helps detect
Rules that depend on it
Splunk 2
Elastic 5
- M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs
- M365 Identity OAuth Flow by User Sign-in to Device Registration
- M365 Identity OAuth Phishing via First-Party Microsoft Application
- M365 Identity OAuth ROPC Grant via Legacy Authentication Client
- M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA)