Azure risk detection: Suspicious browser sign-in activity across countries and tenants

Flags Azure suspicious browser risk events tied to anomalous sign-ins across tenants and countries from the same browser.

FreeUnreviewedSigmahighv1

azure-risk-detection-suspicious-browser-sign-in-activity-across-countries-and-te-944f6adb

title: "Azure risk detection: Suspicious browser sign-in activity across countries and tenants"
id: 6614d8a3-242d-4da6-bfef-e5860eabe225
status: test
description: This rule flags suspicious browser-related risk events where the risk event type is set to suspiciousBrowser. The activity is notable because it indicates anomalous sign-in behavior involving multiple tenants and different countries originating from the same browser session. Detection relies on Azure risk event telemetry from the riskdetection service, specifically the riskEventType field. Correlating the flagged sessions with other user sign-in activity is recommended to validate whether the behavior is legitimate or malicious.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-browser
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_suspicious_browser.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: suspiciousBrowser
  condition: selection
falsepositives:
  - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
  - id: 944f6adb-7a99-4c69-80c1-b712579e93e6
    type: derived

What it detects

This rule flags suspicious browser-related risk events where the risk event type is set to suspiciousBrowser. The activity is notable because it indicates anomalous sign-in behavior involving multiple tenants and different countries originating from the same browser session. Detection relies on Azure risk event telemetry from the riskdetection service, specifically the riskEventType field. Correlating the flagged sessions with other user sign-in activity is recommended to validate whether the behavior is legitimate or malicious.

Known false positives

We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.