Anomalous User Activity

Rule Info

Name

Anomalous User Activity

Author

Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'

Description

Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.

Reference

https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-user-activity

Date

2023-09-03 00:00:00

Modified

None

258b6593-215d-4a26-a141-c8e31c1299a6

Rule History

Author

Title

Date

Commit

Nasreddine Bencherchali

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12

598d29f81

Ryan Plas

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02

1d40f1d20

github-actions[bot]

Merge PR #4891 from @nasbench - Promote older rules status from `experimental` to `test`

2024-07-01

47085e948

Mark Morowczynski

Merge PR #4423 from @MarkMorow - Add Azure AD Identity Protection Rules

2023-09-06

efe2c9bbc

frack113

Change field name in detection

2023-08-10

450b619c1

Nasreddine Bencherchali

chore: change service name to lowercase

2023-08-08

67d0d2aff

frack113

Fix to pass the tests

2023-08-08

a66b38d3d

Mark Morowczynski

Update azure_identity_protectection_anomalous_token.yml

2023-08-07

fa780ec7b

Mark Morowczynski

Create azure_identity_protectection_anomalous_token.yml

2023-08-07

ef2d8b4c9