identity_protection

Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.

Anomalous User Activity

Sep 6, 2023 · attack.t1098 attack.persistence ·

Share on:

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

Atypical Travel

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

Azure AD Account Credential Leaked

Sep 6, 2023 · attack.t1589 attack.reconnaissance ·

Share on:

Indicates that the user's valid credentials have been leaked.

Impossible Travel

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

New Country

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.

Password Spray Activity

Sep 6, 2023 · attack.t1110 attack.credential_access ·

Share on:

Indicates that a password spray attack has been successfully performed.

SAML Token Issuer Anomaly

Sep 6, 2023 · attack.t1606 attack.credential_access ·

Share on:

Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns

Sign-In From Malware Infected IP

Sep 6, 2023 · attack.t1090 attack.command_and_control ·

Share on:

Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.

Suspicious Browser Activity

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser

Suspicious Inbox Forwarding Identity Protection

Sep 6, 2023 · attack.t1140 attack.defense_evasion ·

Share on:

Indicates suspicious rules such as an inbox rule that forwards a copy of all emails to an external address

Suspicious Inbox Manipulation Rules

Sep 6, 2023 · attack.t1140 attack.defense_evasion ·

Share on:

Detects suspicious rules that delete or move messages or folders are set on a user's inbox.

Unfamiliar Sign-In Properties

Sep 6, 2023 · attack.t1078 attack.persistence attack.defense_evasion attack.privilege_escalation attack.initial_access ·

Share on:

Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.

Anonymous IP Address

Aug 23, 2023 · attack.t1528 attack.credential_access ·

Share on:

Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.