Azure AD risk detection: Anomalous user activity (riskEventType anomalousUserActivity)

title: "Azure AD risk detection: Anomalous user activity (riskEventType anomalousUserActivity)"
id: 49e80219-7915-4ff7-b0f6-9f82cc6aea52
status: test
description: This rule flags Azure AD risk events where the riskEventType is anomalousUserActivity, indicating unusual patterns of user behavior such as suspicious directory-related changes. Attackers may leverage legitimate credentials and directory modifications to persist or escalate access, making these anomalies high-signal for investigation. The detection relies on Azure risk telemetry from the riskdetection service, specifically the riskEventType field.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-user-activity
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_user.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.privilege-escalation
  - attack.t1098
  - attack.persistence
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: anomalousUserActivity
  condition: selection
falsepositives:
  - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
  - id: 258b6593-215d-4a26-a141-c8e31c1299a6
    type: derived