identity_protection

Activity From Anonymous IP Address

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.

Anomalous Token

Aug 12, 2024 · attack.t1528 attack.credential-access ·

Share on:

Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.

Anomalous User Activity

Aug 12, 2024 · attack.t1098 attack.persistence ·

Share on:

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

Anonymous IP Address

Aug 12, 2024 · attack.t1528 attack.credential-access ·

Share on:

Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

Atypical Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Azure AD Account Credential Leaked

Aug 12, 2024 · attack.t1589 attack.reconnaissance ·

Share on:

Indicates that the user's valid credentials have been leaked.

Azure AD Threat Intelligence

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Indicates user activity that is unusual for the user or consistent with known attack patterns.

Impossible Travel

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

Malicious IP Address Sign-In Failure Rate

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-in from a malicious IP address based on high failure rates.

Malicious IP Address Sign-In Suspicious

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

New Country

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Password Spray Activity

Aug 12, 2024 · attack.t1110 attack.credential-access ·

Share on:

Indicates that a password spray attack has been successfully performed.

Primary Refresh Token Access Attempt

Aug 12, 2024 · attack.t1528 attack.credential-access ·

Share on:

Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft

SAML Token Issuer Anomaly

Aug 12, 2024 · attack.t1606 attack.credential-access ·

Share on:

Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns

Sign-In From Malware Infected IP

Aug 12, 2024 · attack.t1090 attack.command-and-control ·

Share on:

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

Suspicious Browser Activity

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Suspicious Inbox Forwarding Identity Protection

Aug 12, 2024 · attack.t1140 attack.defense-evasion ·

Share on:

Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address

Suspicious Inbox Manipulation Rules

Aug 12, 2024 · attack.t1140 attack.defense-evasion ·

Share on:

Detects suspicious rules that delete or move messages or folders are set on a user's inbox.

Unfamiliar Sign-In Properties

Aug 12, 2024 · attack.t1078 attack.persistence attack.defense-evasion attack.privilege-escalation attack.initial-access ·

Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.