Microsoft Cloud App Security: Successful logins from Microsoft threat-intel risky IPs

Alert on successful Cloud App Security activity events tied to IPs marked risky by Microsoft Threat Intelligence.

FreeUnreviewedSigmamediumv1

microsoft-cloud-app-security-successful-logins-from-microsoft-threat-intel-risky-a3501e8e

title: "Microsoft Cloud App Security: Successful logins from Microsoft threat-intel risky IPs"
id: 2a94a503-071b-4282-b8eb-5b869637acef
status: test
description: This rule flags successful "Activity from suspicious IP addresses" events where the source is SecurityComplianceCenter and the IP is identified as risky by Microsoft Threat Intelligence. Risky IP activity can indicate attacker infrastructure such as command-and-control or the presence of a compromised account. Telemetry relies on Microsoft Cloud App Security threat detection events that report activity status and the suspicious-IP classification.
references:
  - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_detection/microsoft365_from_susp_ip_addresses.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
  - attack.command-and-control
  - attack.t1573
logsource:
  service: threat_detection
  product: m365
detection:
  selection:
    eventSource: SecurityComplianceCenter
    eventName: Activity from suspicious IP addresses
    status: success
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a3501e8e-af9e-43c6-8cd6-9360bdaae498
    type: derived

What it detects

This rule flags successful "Activity from suspicious IP addresses" events where the source is SecurityComplianceCenter and the IP is identified as risky by Microsoft Threat Intelligence. Risky IP activity can indicate attacker infrastructure such as command-and-control or the presence of a compromised account. Telemetry relies on Microsoft Cloud App Security threat detection events that report activity status and the suspicious-IP classification.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.