Sign-In From Malware Infected IP Address
This rule detects sign-in attempts originating from IP addresses that have been identified as infected with malware. These malware-infected IP addresses are known to actively communicate with bot servers, indicating a high risk of compromise or malicious activity associated with the sign-in.
Sigma
