Azure RiskDetection: Anonymous IP Address Sign-Ins

Detects Azure sign-in risk events labeled as anonymized/anonymous IP addresses.

FreeUnreviewedSigmahighv1

azure-riskdetection-anonymous-ip-address-sign-ins-53acd925

title: "Azure RiskDetection: Anonymous IP Address Sign-Ins"
id: 80572e00-e16b-4f4f-8a87-5e1c0715cf2e
status: test
description: This rule flags sign-in risk events where the IP address is anonymized, such as from an anonymous browser or VPN. Attackers may use these methods to obscure the source of sign-in attempts and reduce the likelihood of detection. It relies on Azure RiskDetection telemetry indicating the riskEventType value associated with anonymized IP addresses.
references:
  - https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anonymous-ip-address
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_address.yml
author: Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-08-22
tags:
  - attack.t1528
  - attack.credential-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: anonymizedIPAddress
  condition: selection
falsepositives:
  - We recommend investigating the sessions flagged by this detection in the context of other sign-ins
level: high
license: DRL-1.1
related:
  - id: 53acd925-2003-440d-a1f3-71a5253fe237
    type: derived

What it detects

This rule flags sign-in risk events where the IP address is anonymized, such as from an anonymous browser or VPN. Attackers may use these methods to obscure the source of sign-in attempts and reduce the likelihood of detection. It relies on Azure RiskDetection telemetry indicating the riskEventType value associated with anonymized IP addresses.

Known false positives

We recommend investigating the sessions flagged by this detection in the context of other sign-ins

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.