Malicious IP Address Sign-In Detected by Entra ID Protection
This rule detects sign-in attempts originating from IP addresses that Microsoft Entra ID Protection has identified as malicious. These IP addresses are known to be associated with attackers or compromised systems at the time of the sign-in, indicating a high-risk authentication attempt.
Sigma
