Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect whenever Microsoft Entra ID Protection categorizes a Microsoft Entra ID login as risky.

Strategy

Monitor Microsoft Entra ID sign in activity (@evt.name:"Sign-in activity") and generate a signal when Entra ID Protection identifies the user as risky or compromised (@properties.riskState:"atRisk" OR "confirmedCompromised").

Triage and response

1. Analyze the location (@network.client.geoip.subdivision.name) of {{@usr.id}} to determine if they’re logging into from their usual location.
2. If log in activity is not legitimate, disable {{@usr.id}} account.
3. Investigate any devices owned by {{@usr.id}}.

Changelog

14 June 2022 - Updated rule query.