huntrule

Microsoft Cloud App Security: Success events from Infrequent Countries

Alerts on successful Microsoft Cloud App Security anomaly events for activity from countries not recently visited by your users.

FreeUnreviewedSigmamediumv1
title: "Microsoft Cloud App Security: Success events from Infrequent Countries"
id: bdb2ece6-6d1d-4a1a-8556-162afa308617
status: test
description: This rule flags successful “Activity from infrequent country” events reported by Microsoft Cloud App Security when the source location is not one that any user in the organization has recently or ever visited. Attackers commonly rely on new geographic locations to mask activity and blend with low-prevalence patterns, so these anomalies are a useful signal. It relies on Microsoft threat management telemetry with eventSource SecurityComplianceCenter and eventName “Activity from infrequent country” indicating a success outcome.
references:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_activity_from_infrequent_country.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
  - attack.command-and-control
  - attack.t1573
logsource:
  service: threat_management
  product: m365
detection:
  selection:
    eventSource: SecurityComplianceCenter
    eventName: Activity from infrequent country
    status: success
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 0f2468a2-5055-4212-a368-7321198ee706
    type: derived

What it detects

This rule flags successful “Activity from infrequent country” events reported by Microsoft Cloud App Security when the source location is not one that any user in the organization has recently or ever visited. Attackers commonly rely on new geographic locations to mask activity and blend with low-prevalence patterns, so these anomalies are a useful signal. It relies on Microsoft threat management telemetry with eventSource SecurityComplianceCenter and eventName “Activity from infrequent country” indicating a success outcome.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.