Anonymous IP Address

calendar Aug 23, 2023 · attack.t1528 attack.credential_access  ·
Share on: linkedin copy

Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

Sigma rule (View on GitHub)

 1title: Anonymous IP Address
 2id: 53acd925-2003-440d-a1f3-71a5253fe237
 3status: experimental
 4description: Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.
 5references:
 6    - https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0
 7    - https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#anonymous-ip-address
 8author: Gloria Lee, '@gleeiamglo'
 9date: 2023/08/22
10tags:
11    - attack.t1528
12    - attack.credential_access
13logsource:
14    product: azure
15    service: riskdetection
16detection:
17    selection:
18        riskEventType: 'anonymizedIPAddress'
19    condition: selection
20falsepositives:
21     - We recommend investigating the sessions flagged by this detection in the context of other sign-ins
22level: high

References

Related rules

to-top