M365 Threat Management: Activity from Anonymous Proxy IP Addresses
Alerts when Microsoft 365 threat management reports successful activity from IPs marked as anonymous proxies.
- Product
- m365
- Service
- threat_management
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-23
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags successful Microsoft Cloud App Security events indicating user activity sourced from an IP address identified as an anonymous proxy. Attackers may hide origin and blend into legitimate traffic by routing through anonymizing infrastructure. The detection relies on SecurityComplianceCenter telemetry with an eventSource, eventName of “Activity from anonymous IP addresses,” and a success status.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_activity_from_anonymous_ip_addresses.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "M365 Threat Management: Activity from Anonymous Proxy IP Addresses"
id: 0838a26b-32c7-4073-ad53-c2d15811dd1f
status: test
description: This rule flags successful Microsoft Cloud App Security events indicating user activity sourced from an IP address identified as an anonymous proxy. Attackers may hide origin and blend into legitimate traffic by routing through anonymizing infrastructure. The detection relies on SecurityComplianceCenter telemetry with an eventSource, eventName of “Activity from anonymous IP addresses,” and a success status.
references:
- https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_activity_from_anonymous_ip_addresses.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
- attack.command-and-control
- attack.t1573
logsource:
service: threat_management
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: Activity from anonymous IP addresses
status: success
condition: selection
falsepositives:
- User using a VPN or Proxy
level: medium
license: DRL-1.1
related:
- id: d8b0a4fe-07a8-41be-bd39-b14afa025d95
type: derived