Activity from Anonymous IP Addresses Reported by Microsoft Cloud App Security
Detects when Microsoft Cloud App Security reports user activity originating from an IP address identified as an anonymous proxy. This indicates potential attempts to obscure the true source of network connections, which could be used for malicious purposes such as bypassing security controls or maintaining anonymity during an attack.
Sigma
