• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Privileged User Logon from new ASN

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•0•30

    'Detects a successful logon by a privileged account from an ASN not logged in from in the last 14 days. Monitor these logons to ensure they are legitimate and identify if there are any similar sign ins.'

    Microsoft Sentinel (KQL)

    Tags

    TA0001 - Initial AccessTA0006 - Credential AccessDS0026 - Active DirectoryM1015 - Active Directory ConfigurationS0684 - ROADToolsM1026 - Privileged Account ManagementTA0004 - Privilege EscalationT1098 - Account ManipulationT1037.003 - Network Logon ScriptT1037 - Boot or Logon Initialization ScriptsT1547 - Boot or Logon Autostart ExecutionT1050 - New ServiceS0039 - NetS1189 - Neo-reGeorgT1078.004 - Cloud AccountsTA0003 - PersistenceTA0005 - Defense EvasionDS0028 - Logon SessionAuthentication SuccessAuthentication AttemptRemote Access SessionAdmin ActivityAzureSaas ApplicationAzure Signin LogskqlAADSecOpsGuidetactic:DefenseEvasiontechnique:T1078.004

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?