Azure (Entra ID) Risk Detection: Threat Intelligence-Driven Unusual User Activity
Flags Azure AD risk investigation events tied to threat-intelligence sign-in indicators using riskdetection telemetry.
- Product
- azure
- Service
- riskdetection
- Author
- Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' (SigmaHQ), DRL 1.1
- Published
- 2023-09-07
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Azure risk events where riskEventType indicates an investigationsThreatIntelligence finding. The behavior matters because it points to user activity that is unusual for the account or aligns with known attack patterns, which attackers may use for stealthy access or account manipulation. It relies on telemetry from Azure risk detection (riskdetection) capturing threat-intelligence investigation events.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-sign-in
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-user
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_threat_intel.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure (Entra ID) Risk Detection: Threat Intelligence-Driven Unusual User Activity"
id: 3e545b10-77c9-4178-b728-0d2c78e2ba00
status: test
description: This rule flags Azure risk events where riskEventType indicates an investigationsThreatIntelligence finding. The behavior matters because it points to user activity that is unusual for the account or aligns with known attack patterns, which attackers may use for stealthy access or account manipulation. It relies on telemetry from Azure risk detection (riskdetection) capturing threat-intelligence investigation events.
references:
- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-sign-in
- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-user
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_threat_intel.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-07
tags:
- attack.stealth
- attack.t1078
- attack.persistence
- attack.privilege-escalation
- attack.initial-access
logsource:
product: azure
service: riskdetection
detection:
selection:
riskEventType: investigationsThreatIntelligence
condition: selection
falsepositives:
- We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
- id: a2cb56ff-4f46-437a-a0fa-ffa4d1303cba
type: derived