Microsoft Cloud App Security: Activity from Microsoft Threat Intelligence Risky IPs
Alert on successful Cloud App Security activity events tied to IPs marked risky by Microsoft Threat Intelligence.
- Product
- m365
- Service
- threat_detection
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-08-23
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule matches Microsoft Cloud App Security threat detection events indicating successful activity from IP addresses marked as risky by Microsoft Threat Intelligence. Such IPs are associated with malicious infrastructure (for example, botnet command-and-control) and may suggest account compromise or automated abuse. It relies on SecurityComplianceCenter activity telemetry carrying the event name and success status.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_detection/microsoft365_from_susp_ip_addresses.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Microsoft Cloud App Security: Activity from Microsoft Threat Intelligence Risky IPs"
id: 2a94a503-071b-4282-b8eb-5b869637acef
status: test
description: This rule matches Microsoft Cloud App Security threat detection events indicating successful activity from IP addresses marked as risky by Microsoft Threat Intelligence. Such IPs are associated with malicious infrastructure (for example, botnet command-and-control) and may suggest account compromise or automated abuse. It relies on SecurityComplianceCenter activity telemetry carrying the event name and success status.
references:
- https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/m365/threat_detection/microsoft365_from_susp_ip_addresses.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-08-23
modified: 2022-10-09
tags:
- attack.command-and-control
- attack.t1573
logsource:
service: threat_detection
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: Activity from suspicious IP addresses
status: success
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: a3501e8e-af9e-43c6-8cd6-9360bdaae498
type: derived