Activity from Suspicious IP Addresses (M365 Cloud App Security)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•28

Detects when Microsoft Cloud App Security reports that users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are associated with malicious activities, such as Botnet Command and Control, and may indicate a compromised account.