Sign In Attempts Using Deprecated TLS Versions

Query

AADSignInEventsBeta
| where ErrorCode == 0
| mv-apply d = parse_json(AuthenticationProcessingDetails) on (
    extend key = tostring(d.key), value = tostring(d.value)
    | summarize details = make_bag(pack(key, value))
)
| extend LegacyTLS = tostring(details['Legacy TLS (TLS 1.0, 1.1, 3DES)'])
| where tolower(LegacyTLS) == "true"
| summarize Sessions = count()  
    by AccountUpn, ApplicationId, UserAgent, Timestamp,ReportId
| order by Sessions desc

About this query

MITRE ATT&CK Technique(s)

Technique ID	Title
T1078	Valid Accounts

Author: Sergio Albea (16/09/2025)

Sign-in Attempts Using Deprecated TLS Versions

Description: This query identifies Azure AD sign-ins that are using legacy TLS versions (below TLS 1.2). It highlights the accounts, devices, and applications involved, providing visibility into insecure protocol usage. Tracking these events helps detect weak encryption risks and enables proactive remediation to enforce modern, secure standards.

Explanation

This query is designed to identify and analyze Azure Active Directory (Azure AD) sign-in attempts that use outdated and insecure versions of the TLS protocol, specifically versions below TLS 1.2. Here's a simplified breakdown of what the query does:

Data Source: It starts by examining the AADSignInEventsBeta table, which contains records of sign-in events.
Filter for Successful Sign-ins: It filters the data to include only successful sign-in attempts, indicated by an ErrorCode of 0.
Extract Authentication Details: The query processes the AuthenticationProcessingDetails field to extract key-value pairs, creating a structured view of the authentication details.
Identify Legacy TLS Usage: It checks if the sign-in used legacy TLS protocols (TLS 1.0, TLS 1.1, or 3DES) by looking for a specific flag (Legacy TLS) in the authentication details.
Filter for Legacy TLS: Only sign-ins that used these outdated protocols are kept for further analysis.
Summarize and Count Sessions: The query groups the results by user account (AccountUpn), application ID (ApplicationId), user agent, timestamp, and report ID, counting the number of sessions for each group.
Order by Session Count: Finally, it orders the results by the number of sessions in descending order, highlighting which accounts, applications, or devices are most frequently using insecure protocols.

Overall, this query helps organizations identify and address security risks associated with using deprecated encryption protocols, allowing them to enforce more secure standards.

KQL Search