1200KM / sigma-rule
Activity from Suspicious IP Addresses — Sigma Rule
Sigma rule a3501e8e-af9e-43c6-8cd6-9360bdaae498. Activity from Suspicious IP Addresses — Sigma Rule. Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
Rule metadata and linked tags
Author: Austin Songer @austinsonger. Source status: test; severity: medium. Source dates: 2021-08-23 / 2022-10-09.
{
"service": "threat_detection",
"product": "m365"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: f7799957a0d9f7b995fd0fcee25c010d672c4b54006e43110980a9d3c87fbac6
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Activity from Suspicious IP Addresses
id: a3501e8e-af9e-43c6-8cd6-9360bdaae498
status: test
description: |
Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
references:
- https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
author: Austin Songer @austinsonger
date: 2021-08-23
modified: 2022-10-09
tags:
- attack.command-and-control
- attack.t1573
logsource:
service: threat_detection
product: m365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: 'Activity from suspicious IP addresses'
status: success
condition: selection
falsepositives:
- Unknown
level: medium
False positives
- Unknown
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.