valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 17:58:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1643 from austinsonger/microsoft365_impossible_travel

Browse Source 
Microsoft365 impossible travel
This commit is contained in:
Florian Roth 2021-07-07 10:11:03 +02:00 committed by GitHub
commit 1c032c84be
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
rules/cloud/microsoft365_impossible_travel_activity.yml Normal file
View File

@ -0,0 +1,27 @@
title: Microsoft 365 - Impossible Travel Activity
id: d7eab125-5f94-43df-8710-795b80fa1189
status: experimental
description: Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.
author: austinsonger
date: 2020/07/06
modified: 2020/07/06
references:
- https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy
- https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference
logsource:
category: ThreatManagement
service: Office365
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: "Impossible travel activity"
status: success
condition: selection
falsepositives:
-
level: medium
tags:
- attack.initial_access
- attack.t1078