Anonymous IP Address

 1title: Anonymous IP Address
 2id: 53acd925-2003-440d-a1f3-71a5253fe237
 3status: test
 4description: Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.
 5references:
 6    - https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0
 7    - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anonymous-ip-address
 8author: Gloria Lee, '@gleeiamglo'
 9date: 2023-08-22
10tags:
11    - attack.t1528
12    - attack.credential-access
13logsource:
14    product: azure
15    service: riskdetection
16detection:
17    selection:
18        riskEventType: 'anonymizedIPAddress'
19    condition: selection
20falsepositives:
21    - We recommend investigating the sessions flagged by this detection in the context of other sign-ins
22level: high

References

• riskDetection resource type - Microsoft Graph v1.0

  

  Represents all risk detections in a Microsoft Entra tenant.

  
  Read More

• What are risks in Microsoft Entra ID Protection - Microsoft Entra ID Protection

  

  Explaining risk detections in Microsoft Entra ID Protection

  
  Read More

Related rules

• Anomalous Token
• App Granted Microsoft Permissions
• Application URI Configuration Changes
• Delegated Permissions Granted For All Users
• End User Consent