Every published rule

Azure risk detection: Malicious IP sign-in risk event based on sign-in failure rate

Flags Azure risk events for sign-ins associated with malicious IPs using maliciousIPAddress failure-rate indications.

Azure Entra sign-in risk: Unfamiliar sign-in properties

Alerts on Azure risk events where sign-in properties are marked unfamiliar compared to a user’s historical patterns.

Azure SAML Token Issuer Anomaly via riskdetection

Flags Azure risk events where a SAML token’s issuer and claims look anomalous or attacker-like.

Azure Entra suspicious browser risk events across multiple tenants and countries

Flags Azure suspicious browser risk events tied to anomalous sign-ins across tenants and countries from the same browser.

Azure Entra ID risk event: successful password spray detection

Flags Azure Entra ID risk events indicating a successful password spray attempt.

Azure Entra ID sign-in risk: new country (riskEventType newCountry)

Flags Azure AD risk events where a sign-in is assessed as originating from a new country for the user.

Azure Identity Risk: Sign-ins from Malware-Infected IP Addresses

Flags Azure sign-in risk events originating from malware-infected IP addresses linked to bot-server communication.

Azure AD LeakedCredentials Risk Event Indicates User Credential Exposure

Alerts on Azure AD risk events indicating user credentials were leaked (riskEventType: leakedCredentials).

Azure risk event: Suspicious inbox manipulation rules that delete or move messages or folders

Alerts on Azure risk events for suspicious inbox rules that delete or move mailbox items.

Azure Risk Event: Suspicious Inbox Forwarding

Alerts on Azure Identity Protection risk events indicating inbox forwarding to an external address.

Azure AD User Login Risk: Impossible Travel from Distant Locations

Flags Azure Entra risk events tagged as impossibleTravel indicating implausible geographic sign-in travel within a short time.

Azure Entra ID Identity Protection Unlikely Travel Risk Events

Alerts on unlikelyTravel risk events tied to geographically distant sign-ins and potential deviation from user travel history.

Azure RiskDetection flags riskyIPAddress from anonymous proxy IP addresses

Alerts when Azure reports user activity linked to a risky anonymous proxy IP address.

Azure Entra ID anomalous user activity risk event

Alerts on Azure AD risk events indicating anomalous user activity via riskEventType=anomalousUserActivity.

Azure Entra ID Riskdetection: Anonymous IP Address sign-in risk events

Detects Azure sign-in risk events labeled as anonymized/anonymous IP addresses.

Azure risk detection: anomalousToken risk events

Flags Azure Entra ID risk events indicating anomalous token lifetime or use from unfamiliar locations.

AWS CloudTrail: S3 Browser Creates IAM User or Access Key

Alerts on CloudTrail IAM CreateUser/CreateAccessKey actions initiated by a "S3 Browser" user agent.

AWS CloudTrail: S3 Browser creates inline IAM policy with default bucket placeholder

Detects S3 Browser–initiated IAM PutUserPolicy requests that include a templated S3 bucket placeholder in the inline policy.

AWS CloudTrail: S3 Browser creating IAM LoginProfiles after querying GetLoginProfile

Flags CloudTrail IAM GetLoginProfile and CreateLoginProfile activity initiated by an S3 Browser user agent.

Azure Sign-in Success with Legacy Client User-Agent Indicators (MFA Bypass Suspicion)

Alerts on successful Azure sign-ins using legacy client user-agent markers that may indicate MFA bypass attempts.