Suspicious Behavior Performed by Terminated User (via threat_management)

title: Suspicious Behavior Performed by Terminated User (via threat_management)
id: 50721437-58df-5762-b2fa-753ba6c68445
status: stable
description: This rule detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are frequently not terminated when a user leaves the company.
references:
    - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
    - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
author: Huntrule Team
date: 2026-02-26
tags:
    - attack.impact
    - attack.persistence
    - attack.defense-evasion
    - attack.t1078
logsource:
    service: threat_management
    product: m365
detection:
    selection:
        eventSource: SecurityComplianceCenter
        eventName: 'Activity performed by terminated user'
        status: success
    condition: selection
falsepositives:
    - Unknown
level: medium