• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Device Logons from Unknown IPs

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•0•15

    Device Logons from Unknown IP Addresses. This query identifies device logons from IP addresses not associated with any machine in Defender ATP.

    Microsoft Sentinel (KQL)

    Tags

    T1021 - Remote ServicesTA0008 - Lateral MovementT1078 - Valid AccountsT1133 - External Remote ServicesTA0005 - Defense EvasionTA0003 - PersistenceTA0004 - Privilege EscalationTA0001 - Initial AccessT1219 - Remote Access ToolsTA0011 - Command and ControlLogon EventAuthentication SuccessNetwork ConnectionWindowsMicrosoft Exchange ServerWindows Defender AtpM365 Unified Audit Logkql

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?