M365 SecurityComplianceCenter: Successful logon from risky IP address in sanctioned apps

title: "M365 SecurityComplianceCenter: Successful logon from risky IP address in sanctioned apps"
id: 88c9c28e-792b-4bcc-b403-7937eb56ffc9
status: test
description: This rule flags successful sign-ins reported by Microsoft Cloud App Security when a user logs into your sanctioned apps from a risky IP address. Attackers can use compromised or anomalous network locations to evade monitoring, so identifying these sign-ins helps prioritize investigation. The detection relies on threat management telemetry in the SecurityComplianceCenter for eventSource, eventName, and success status.
references:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_logon_from_risky_ip_address.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078
logsource:
  service: threat_management
  product: m365
detection:
  selection:
    eventSource: SecurityComplianceCenter
    eventName: Log on from a risky IP address
    status: success
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c191e2fa-f9d6-4ccf-82af-4f2aba08359f
    type: derived