Azure Risk Detections: Malicious IP Sign-In Failure Rate

Flags Azure risk events for sign-ins associated with malicious IPs using maliciousIPAddress failure-rate indications.

FreeUnreviewedSigmahighv1

azure-risk-detections-malicious-ip-sign-in-failure-rate-a3f55ebd

title: "Azure Risk Detections: Malicious IP Sign-In Failure Rate"
id: f6e33e6a-a4e2-4a3e-898c-15f00679b4ba
status: test
description: This rule flags risk events where the riskEventType is maliciousIPAddress, indicating sign-in activity associated with a malicious IP based on unusually high sign-in failure rates. Attackers often probe or brute-force credentials from hostile infrastructure, and elevated failure patterns tied to an IP can support early risk triage. The detection relies on Azure risk detection telemetry that records the riskEventType for the event.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-07
tags:
  - attack.t1090
  - attack.command-and-control
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: maliciousIPAddress
  condition: selection
falsepositives:
  - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
  - id: a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd
    type: derived

What it detects

This rule flags risk events where the riskEventType is maliciousIPAddress, indicating sign-in activity associated with a malicious IP based on unusually high sign-in failure rates. Attackers often probe or brute-force credentials from hostile infrastructure, and elevated failure patterns tied to an IP can support early risk triage. The detection relies on Azure risk detection telemetry that records the riskEventType for the event.

Known false positives

We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.