Microsoft 365 Threat Management: Activity from Anonymous Proxy IP Addresses

Alerts when Microsoft 365 threat management reports successful activity from IPs marked as anonymous proxies.

FreeUnreviewedSigmamediumv1

microsoft-365-threat-management-activity-from-anonymous-proxy-ip-addresses-d8b0a4fe

title: "Microsoft 365 Threat Management: Activity from Anonymous Proxy IP Addresses"
id: 0838a26b-32c7-4073-ad53-c2d15811dd1f
status: test
description: This rule flags Microsoft Cloud App Security alerts indicating user activity originating from IP addresses identified as anonymous proxies. Attackers may route traffic through proxy infrastructure to obscure origin while attempting to access cloud resources. The detection relies on SecurityComplianceCenter events in the threat management telemetry that report successful 'Activity from anonymous IP addresses' status.
references:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_activity_from_anonymous_ip_addresses.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
  - attack.command-and-control
  - attack.t1573
logsource:
  service: threat_management
  product: m365
detection:
  selection:
    eventSource: SecurityComplianceCenter
    eventName: Activity from anonymous IP addresses
    status: success
  condition: selection
falsepositives:
  - User using a VPN or Proxy
level: medium
license: DRL-1.1
related:
  - id: d8b0a4fe-07a8-41be-bd39-b14afa025d95
    type: derived

What it detects

This rule flags Microsoft Cloud App Security alerts indicating user activity originating from IP addresses identified as anonymous proxies. Attackers may route traffic through proxy infrastructure to obscure origin while attempting to access cloud resources. The detection relies on SecurityComplianceCenter events in the threat management telemetry that report successful 'Activity from anonymous IP addresses' status.

Known false positives

User using a VPN or Proxy

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.