Activity from Suspicious IP Addresses

Title: Activity from Suspicious IP Addresses
Status: test
Description:Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
References:
  -https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
  -https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
Author: Austin Songer @austinsonger
Date: 2021-08-23
modified:2022-10-09
Tags:

• -'attack.command-and-control'
• -'attack.t1573'

Logsource:

• service: threat_detection
• product: m365

Detection:
  selection:
    eventSource: 'SecurityComplianceCenter'
    eventName: 'Activity from suspicious IP addresses'
    status: 'success'
  condition:selection
Falsepositives:
  -Unknown
Level: medium