Malicious IP Address Sign-In Suspicious

Rule Info

Name

Malicious IP Address Sign-In Suspicious

Author

Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'

Description

Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.

Reference

https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address

Date

2023-09-07 00:00:00

Modified

None

36440e1c-5c22-467a-889b-593e66498472

Rule History

Author

Title

Date

Commit

Nasreddine Bencherchali

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12

598d29f81

github-actions[bot]

Merge PR #4942 from @nasbench - promote older rules status from experimental to test

2024-08-01

6b7814466

Ryan Plas

Merge PR #4893 from @ryanplasma - Update Microsoft references URLS

2024-07-02

1d40f1d20

Mark Morowczynski

Merge PR #4429 from @MarkMorow - Add New Azure Identity Protection Rules

2023-09-11

e5fabcbd2

Mark Morowczynski

Merge PR #4423 from @MarkMorow - Add Azure AD Identity Protection Rules

2023-09-06

efe2c9bbc

frack113

Change field name in detection

2023-08-10

450b619c1

Nasreddine Bencherchali

chore: change service name to lowercase

2023-08-08

67d0d2aff

frack113

Fix to pass the tests

2023-08-08

a66b38d3d

Mark Morowczynski

Update azure_identity_protectection_anomalous_token.yml

2023-08-07

fa780ec7b

Mark Morowczynski

Create azure_identity_protectection_anomalous_token.yml

2023-08-07

ef2d8b4c9