Sigma detection rules, expert-reviewed

Azure PIM Invalid License Alert Incident

Alerts when Azure PIM reports an invalid or missing license condition for the organization.

Azure PIM Stale Sign-In Alert for Privileged Role Accounts

Alerts when Azure PIM reports a privileged account has gone stale due to no sign-in activity.

Azure (Entra ID) Risk Detection: Threat Intelligence-Driven Unusual User Activity

Flags Azure AD risk investigation events tied to threat-intelligence sign-in indicators using riskdetection telemetry.

Azure Risk Detection: Attempted Primary Refresh Token (PRT) Access

Identifies Azure risk events indicating an attempted PRT access that can enable lateral movement or credential theft.

Azure Entra Risk Detection: SuspiciousIPAddress Sign-In From Malicious IP

Alerts on Azure Entra sign-in risk events marked suspiciousIPAddress, suggesting origin from a known malicious IP.

Azure risk detection: Malicious IP sign-in risk event based on sign-in failure rate

Flags Azure risk events for sign-ins associated with malicious IPs using maliciousIPAddress failure-rate indications.

Azure Entra sign-in risk: Unfamiliar sign-in properties

Alerts on Azure risk events where sign-in properties are marked unfamiliar compared to a user’s historical patterns.

Azure SAML Token Issuer Anomaly via riskdetection

Flags Azure risk events where a SAML token’s issuer and claims look anomalous or attacker-like.

Azure Entra suspicious browser risk events across multiple tenants and countries

Flags Azure suspicious browser risk events tied to anomalous sign-ins across tenants and countries from the same browser.

Azure Entra ID risk event: successful password spray detection

Flags Azure Entra ID risk events indicating a successful password spray attempt.

Azure Entra ID sign-in risk: new country (riskEventType newCountry)

Flags Azure AD risk events where a sign-in is assessed as originating from a new country for the user.

Azure Identity Risk: Sign-ins from Malware-Infected IP Addresses

Flags Azure sign-in risk events originating from malware-infected IP addresses linked to bot-server communication.

Azure AD LeakedCredentials Risk Event Indicates User Credential Exposure

Alerts on Azure AD risk events indicating user credentials were leaked (riskEventType: leakedCredentials).

Azure risk event: Suspicious inbox manipulation rules that delete or move messages or folders

Alerts on Azure risk events for suspicious inbox rules that delete or move mailbox items.

Azure Risk Event: Suspicious Inbox Forwarding

Alerts on Azure Identity Protection risk events indicating inbox forwarding to an external address.