Azure AD risk detection: New country sign-in

Flags Azure AD risk events where a sign-in is assessed as originating from a new country for the user.

FreeUnreviewedSigmahighv1

azure-ad-risk-detection-new-country-sign-in-adf9f4d2

title: "Azure AD risk detection: New country sign-in"
id: c4a92791-a2d7-46bc-a89d-59cff116b7ed
status: test
description: Identifies sign-in risk events labeled as newCountry. This matters because attackers may use compromised accounts from atypical geographies to evade detection or establish access. The rule relies on Azure riskdetection telemetry that provides riskEventType for sign-in activity and flags when it is assessed as occurring in a new country.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#new-country
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_new_coutry_region.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: newCountry
  condition: selection
falsepositives:
  - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
  - id: adf9f4d2-559e-4f5c-95be-c28dff0b1476
    type: derived

What it detects

Identifies sign-in risk events labeled as newCountry. This matters because attackers may use compromised accounts from atypical geographies to evade detection or establish access. The rule relies on Azure riskdetection telemetry that provides riskEventType for sign-in activity and flags when it is assessed as occurring in a new country.

Known false positives

We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.