Azure Riskdetection: User Activity Triggered by Risky Anonymous Proxy IP

title: "Azure Riskdetection: User Activity Triggered by Risky Anonymous Proxy IP"
id: e28af512-a8f2-40dd-9556-9b14e2df5222
status: test
description: This rule flags risk events where user activity is attributed to an IP address classified as a risky anonymous proxy. Attackers often use proxy infrastructure to obscure origin while attempting access or maintaining stealthy activity. The detection relies on Azure risk telemetry from riskEventType values indicating riskyIPAddress.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#activity-from-anonymous-ip-address
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_activity.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.stealth
  - attack.t1078
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: riskyIPAddress
  condition: selection
falsepositives:
  - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
  - id: be4d9c86-d702-4030-b52e-c7859110e5e8
    type: derived