Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations.
Sigma rule (View on GitHub)
1title: New Country 2id: adf9f4d2-559e-4f5c-95be-c28dff0b1476 3status: experimental 4description: Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations. 5references: 6 - https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#new-country 7 - https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins 8author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' 9date: 2023/09/03 10tags: 11 - attack.t1078 12 - attack.persistence 13 - attack.defense_evasion 14 - attack.privilege_escalation 15 - attack.initial_access 16logsource: 17 product: azure 18 service: riskdetection 19detection: 20 selection: 21 riskEventType: 'newCountry' 22 condition: selection 23falsepositives: 24 - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. 25level: high
- Activity From Anonymous IP Address
- Atypical Travel
- Impossible Travel
- Suspicious Browser Activity
- Unfamiliar Sign-In Properties