Azure AD Sign-in Risk: Malware-Infected IP Address Sign-ins

Flags Azure sign-in risk events originating from malware-infected IP addresses linked to bot-server communication.

FreeUnreviewedSigmahighv1

azure-ad-sign-in-risk-malware-infected-ip-address-sign-ins-821b4dc3

title: "Azure AD Sign-in Risk: Malware-Infected IP Address Sign-ins"
id: 6897d102-9cde-4a5d-ad46-12e632ec0bfc
status: test
description: This rule flags sign-in risk events where the source IP is identified as a malware-infected IP address that is known to communicate with a bot server. Such IPs are a strong indicator of command-and-control activity and may precede account takeover attempts. It relies on Azure risk detection telemetry reporting events labeled as malware-infected IP address sign-ins.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malware-linked-ip-address-deprecated
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_malware_linked_ip.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.t1090
  - attack.command-and-control
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: malwareInfectedIPAddress
  condition: selection
falsepositives:
  - Using an IP address that is shared by many users
level: high
license: DRL-1.1
related:
  - id: 821b4dc3-1295-41e7-b157-39ab212dd6bd
    type: derived

What it detects

This rule flags sign-in risk events where the source IP is identified as a malware-infected IP address that is known to communicate with a bot server. Such IPs are a strong indicator of command-and-control activity and may precede account takeover attempts. It relies on Azure risk detection telemetry reporting events labeled as malware-infected IP address sign-ins.

Known false positives

Using an IP address that is shared by many users

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.