Microsoft Cloud App Security: Activity by Terminated User Across Platforms

title: "Microsoft Cloud App Security: Activity by Terminated User Across Platforms"
id: ade732a0-e135-4483-aad6-4f6d1e9ab000
status: test
description: This rule flags successful events in Microsoft Cloud App Security Threat Management for the activity performed by a terminated user. It highlights cases where an identity that is marked terminated in Azure AD continues to perform actions that may span other connected platforms such as AWS or Salesforce. The detection relies on SecurityComplianceCenter telemetry including eventSource, eventName, and a success status for terminated-user activity.
references:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_activity_by_terminated_user.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
  - attack.impact
logsource:
  service: threat_management
  product: m365
detection:
  selection:
    eventSource: SecurityComplianceCenter
    eventName: Activity performed by terminated user
    status: success
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 2e669ed8-742e-4fe5-b3c4-5a59b486c2ee
    type: derived