Storm-2755 - Post-Compromise Direct Deposit Modification (T1565.002)
This rule correlates a user logging in from a new ISP and immediately navigating to HR/Payroll URIs (specifically Workday or ADP) to modify direct deposit data. The detection logic joins Azure AD sign-in events with Cloud App Security events, filtering for interactive logins and page accesses to specific HR/Payroll URLs containing 'direct-deposit'. It also excludes known corporate IP addresses and requires the HR/Payroll access to occur within 30 minutes of the login.
Microsoft Sentinel (KQL)
