Microsoft Cloud App Security: Alerts for Successful Activity from Infrequent Countries
Alerts on successful Microsoft Cloud App Security anomaly events for activity from countries not recently visited by your users.
- Product
- m365
- Service
- threat_management
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-23
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags successful "Activity from infrequent country" events reported by Microsoft Cloud App Security when an activity originates from a location the organization’s users have not recently, or ever, visited. Attackers commonly use atypical geolocations to evade baseline behavior and to blend in with legitimate access patterns. Detection relies on threat management telemetry from the SecurityComplianceCenter event source, including the event name and success status.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_activity_from_infrequent_country.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Microsoft Cloud App Security: Alerts for Successful Activity from Infrequent Countries"
id: bdb2ece6-6d1d-4a1a-8556-162afa308617
status: test
description: This rule flags successful "Activity from infrequent country" events reported by Microsoft Cloud App Security when an activity originates from a location the organization’s users have not recently, or ever, visited. Attackers commonly use atypical geolocations to evade baseline behavior and to blend in with legitimate access patterns. Detection relies on threat management telemetry from the SecurityComplianceCenter event source, including the event name and success status.
references:
- https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_management/microsoft365_activity_from_infrequent_country.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
- attack.command-and-control
- attack.t1573
logsource:
service: threat_management
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: Activity from infrequent country
status: success
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 0f2468a2-5055-4212-a368-7321198ee706
type: derived