Product
high
advisory
Entra ID Protection Alert Followed by Device Registration
2 rules 2 TTPsDetection of a Microsoft Entra ID protection alert followed by a new device registration attempt by the same user, potentially indicating account compromise and unauthorized device registration for persistence.
Microsoft Entra ID +1
azure
entra_id
persistence
device_registration
2r
2t
high
advisory
Azure Identity Protection Atypical Travel Anomaly
2 rules 1 TTPThe Atypical Travel detection in Azure Identity Protection identifies potentially compromised user accounts by detecting geographically improbable sign-in activity, indicative of account compromise or misuse.
Azure Active Directory +1
azure
identity-protection
atypical-travel
account-compromise
credential-theft
2r
1t