Azure Entra Risk Detection: SuspiciousIPAddress Sign-In From Malicious IP
Alerts on Azure Entra sign-in risk events marked suspiciousIPAddress, suggesting origin from a known malicious IP.
- Product
- azure
- Service
- riskdetection
- Author
- Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' (SigmaHQ), DRL 1.1
- Published
- 2023-09-07
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags sign-in risk events where the risk event type is suspiciousIPAddress, indicating the sign-in originated from an IP address considered malicious at the time of the event. Such alerts matter because attackers may reuse compromised infrastructure to access accounts while blending in with normal sign-in flows. The detection relies on Azure Entra risk event telemetry, specifically the risk event type associated with the sign-in risk record.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address_suspicious.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Entra Risk Detection: SuspiciousIPAddress Sign-In From Malicious IP"
id: bbd583a0-411c-41e0-b236-96da821243d0
status: test
description: This rule flags sign-in risk events where the risk event type is suspiciousIPAddress, indicating the sign-in originated from an IP address considered malicious at the time of the event. Such alerts matter because attackers may reuse compromised infrastructure to access accounts while blending in with normal sign-in flows. The detection relies on Azure Entra risk event telemetry, specifically the risk event type associated with the sign-in risk record.
references:
- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address_suspicious.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-07
tags:
- attack.t1090
- attack.command-and-control
logsource:
product: azure
service: riskdetection
detection:
selection:
riskEventType: suspiciousIPAddress
condition: selection
falsepositives:
- We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
- id: 36440e1c-5c22-467a-889b-593e66498472
type: derived