Azure Entra suspicious browser risk events across multiple tenants and countries
Flags Azure suspicious browser risk events tied to anomalous sign-ins across tenants and countries from the same browser.
- Product
- azure
- Service
- riskdetection
- Author
- Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' (SigmaHQ), DRL 1.1
- Published
- 2023-09-03
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags risk events of type suspiciousBrowser in Azure Entra risk detection. It is intended to surface anomalous sign-in behavior where activity appears to span multiple tenants and originates from different countries within the same browser, which attackers may leverage to evade detection while reusing client context. Telemetry relies on risk detection events reporting riskEventType='suspiciousBrowser'.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-browser
- learn.microsoft.comhttps://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_suspicious_browser.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Azure Entra suspicious browser risk events across multiple tenants and countries
id: 6614d8a3-242d-4da6-bfef-e5860eabe225
status: test
description: This rule flags risk events of type suspiciousBrowser in Azure Entra risk detection. It is intended to surface anomalous sign-in behavior where activity appears to span multiple tenants and originates from different countries within the same browser, which attackers may leverage to evade detection while reusing client context. Telemetry relies on risk detection events reporting riskEventType='suspiciousBrowser'.
references:
- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-browser
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_suspicious_browser.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
- attack.stealth
- attack.t1078
- attack.persistence
- attack.privilege-escalation
- attack.initial-access
logsource:
product: azure
service: riskdetection
detection:
selection:
riskEventType: suspiciousBrowser
condition: selection
falsepositives:
- We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
- id: 944f6adb-7a99-4c69-80c1-b712579e93e6
type: derived