A possible risky login to Azure

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	AzureAD
Detection Modules	Identity Analytics
ATT&CK Tactic	Initial Access (TA0001), Resource Development (TA0042)
ATT&CK Technique	Compromise Accounts (T1586), Valid Accounts (T1078)
Severity	Informational

Description

A risky sign-in attempt was observed in Azure.

Attacker's Goals

An attacker is attempting to compromise an Azure account by exploiting weak or guessed passwords for initial access.

Investigative actions

• Monitor the user account for indications of compromise, such as irregular login patterns or atypical activities.
• Reach out to the user to confirm the legitimacy of the recent password reset activity.
• Continue monitoring the account for any subsequent actions that may indicate suspicious behavior.

Variations

Azure Risky Login with Suspicious Characteristics

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001), Resource Development (TA0042)
ATT&CK Technique	Compromise Accounts (T1586), Valid Accounts (T1078)
Severity	Low

Description

A risky sign-in attempt was observed in Azure.

Attacker's Goals

An attacker is attempting to compromise an Azure account by exploiting weak or guessed passwords for initial access.

Investigative actions

• Monitor the user account for indications of compromise, such as irregular login patterns or atypical activities.
• Reach out to the user to confirm the legitimacy of the recent password reset activity.
• Continue monitoring the account for any subsequent actions that may indicate suspicious behavior.

Azure-Defined High-Risk Login Attempt

Synopsis

Field	Value
ATT&CK Tactic	Initial Access (TA0001), Resource Development (TA0042)
ATT&CK Technique	Compromise Accounts (T1586), Valid Accounts (T1078)
Severity	Low

Description

A risky sign-in attempt was observed in Azure.

Attacker's Goals

An attacker is attempting to compromise an Azure account by exploiting weak or guessed passwords for initial access.

Investigative actions

• Monitor the user account for indications of compromise, such as irregular login patterns or atypical activities.
• Reach out to the user to confirm the legitimacy of the recent password reset activity.
• Continue monitoring the account for any subsequent actions that may indicate suspicious behavior.