New Country
Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.
Sigma rule (View on GitHub)
1title: New Country
2id: adf9f4d2-559e-4f5c-95be-c28dff0b1476
3status: experimental
4description: Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.
5references:
6 - https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#new-country
7 - https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins
8author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
9date: 2023/09/03
10tags:
11 - attack.t1078
12 - attack.persistence
13 - attack.defense_evasion
14 - attack.privilege_escalation
15 - attack.initial_access
16logsource:
17 product: azure
18 service: riskdetection
19detection:
20 selection:
21 riskEventType: 'newCountry'
22 condition: selection
23falsepositives:
24 - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
25level: high
References
Related rules
- Activity From Anonymous IP Address
- Atypical Travel
- Impossible Travel
- Suspicious Browser Activity
- Unfamiliar Sign-In Properties