Azure Risk Detection: Unfamiliar Sign-In Properties Events

title: "Azure Risk Detection: Unfamiliar Sign-In Properties Events"
id: 06095211-82fc-4b9c-9f03-4a417e94b580
status: test
description: This rule flags Azure sign-in risk events of type unfamiliarFeatures, indicating sign-in properties that differ from what is typical for the user. Attackers can use anomalous sign-in characteristics to establish sessions or evade detection, so distinguishing unusual authentication context is important for early triage. The detection relies on Azure risk event telemetry from the riskdetection service and specifically matches riskEventType.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#unfamiliar-sign-in-properties
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_unfamilar_sign_in.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: unfamiliarFeatures
  condition: selection
falsepositives:
  - User changing to a new device, location, browser, etc.
level: high
license: DRL-1.1
related:
  - id: 128faeef-79dd-44ca-b43c-a9e236a60f49
    type: derived