Tag
Monitoring High-Risk Sign-ins in Microsoft Entra ID
1 rule 1 TTPThis brief details the detection of compromised cloud accounts by leveraging Microsoft Identity Protection telemetry to identify high-risk authentication events indicative of credential abuse.
Office 365 User Restricted from Sending Email
2 rules 1 TTPAn Office 365 user account is restricted from sending email, potentially indicating account compromise, policy violation, or administrative action following suspicious activity.
Unusual Country for Cisco Duo Admin Login
2 rules 1 TTP 1 IOCDetection of Cisco Duo admin logins originating from outside the United States indicates potential account compromise or unauthorized access.
M365 Copilot Application Usage Pattern Anomalies
2 rules 1 TTPThis detection identifies anomalous M365 Copilot usage patterns indicative of potential account compromise or automated abuse by flagging users accessing Copilot from multiple locations, generating excessive daily activity, or utilizing multiple Copilot applications.
Cisco Duo Admin Login from Unusual Operating System
2 rules 1 TTP 2 IOCsDetection of Cisco Duo admin login attempts originating from operating systems not typically used in the environment, potentially indicating account compromise or unauthorized access.
Azure AD Multiple Denied MFA Requests Indicating Potential Account Compromise
2 rules 2 TTPsDetection of an unusually high number of denied MFA requests for a single user within a short timeframe in Azure AD, potentially indicating a targeted account compromise attempt.
AWS Console Login by User from New Country
2 rules 1 TTPThis detection identifies AWS console logins by a user originating from a country not previously associated with that user, potentially indicating account compromise.
O365 Email Password and Payroll Compromise
2 rules 3 TTPsAttackers compromise O365 accounts and delete emails related to password resets and payroll changes, potentially redirecting payroll to attacker-controlled accounts.
Azure Identity Protection Atypical Travel Anomaly
2 rules 1 TTPThe Atypical Travel detection in Azure Identity Protection identifies potentially compromised user accounts by detecting geographically improbable sign-in activity, indicative of account compromise or misuse.
Impossible Travel Detection in Azure AD
2 rules 1 TTPThis brief describes the detection of 'impossible travel' events in Azure AD, where a user appears to log in from geographically distant locations within an implausibly short time frame, potentially indicating account compromise.
Google Workspace MFA Enforcement Disabled
2 rules 3 TTPsDetection of multi-factor authentication (MFA) enforcement being disabled for Google Workspace users, potentially weakening security controls and leading to account compromise.