Azure Identity Risk: Sign-ins from Malware-Infected IP Addresses
Flags Azure sign-in risk events originating from malware-infected IP addresses linked to bot-server communication.
FreeReviewedSigma · High · v5
- Product
- azure
- Service
- riskdetection
- Author
- Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' (SigmaHQ), DRL 1.1
- Published
- 2023-09-03
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags sign-in risk events where the source IP is identified as a malware-infected IP address. Attackers can use compromised infrastructure to blend in with legitimate authentication flows and establish command-and-control communications. The detection relies on Azure risk telemetry identifying riskEventType as malwareInfectedIPAddress.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malware-linked-ip-address-deprecated
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_malware_linked_ip.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
azure-ad-sign-in-risk-malware-infected-ip-address-sign-ins-821b4dc3
title: "Azure Identity Risk: Sign-ins from Malware-Infected IP Addresses"
id: 6897d102-9cde-4a5d-ad46-12e632ec0bfc
status: test
description: This rule flags sign-in risk events where the source IP is identified as a malware-infected IP address. Attackers can use compromised infrastructure to blend in with legitimate authentication flows and establish command-and-control communications. The detection relies on Azure risk telemetry identifying riskEventType as malwareInfectedIPAddress.
references:
- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malware-linked-ip-address-deprecated
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_malware_linked_ip.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
- attack.t1090
- attack.command-and-control
logsource:
product: azure
service: riskdetection
detection:
selection:
riskEventType: malwareInfectedIPAddress
condition: selection
falsepositives:
- Using an IP address that is shared by many users
level: high
license: DRL-1.1
related:
- id: 821b4dc3-1295-41e7-b157-39ab212dd6bd
type: derived