Azure AD Risk Detection: Threat Intelligence Sign-In Investigation Events

title: "Azure AD Risk Detection: Threat Intelligence Sign-In Investigation Events"
id: 3e545b10-77c9-4178-b728-0d2c78e2ba00
status: test
description: This rule flags Azure AD risk detection events where the risk event type is an investigation for threat intelligence. Attackers may trigger these signals when their sign-in behavior aligns with known threat-intelligence indicators or deviates from typical user activity. The detection relies on Azure risk detection telemetry in riskdetection, specifically the riskEventType value 'investigationsThreatIntelligence'.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-sign-in
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-user
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_threat_intel.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-07
tags:
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: investigationsThreatIntelligence
  condition: selection
falsepositives:
  - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
  - id: a2cb56ff-4f46-437a-a0fa-ffa4d1303cba
    type: derived