Query: detect Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microso in logs
Matching passage: Sigma rule: Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microso. Logsource: m365 / threat_detection. Rule: title: Activity from Suspicious IP Addresses id: a3501e8e-af9e-43c6-8cd6-9360bdaae498 status: test description: 'Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account. ' references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1573 logsource: service: threat_detection product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Activity from suspicious IP addresses status: success condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects an executable, which is not an internet browser or known application, initiating network connections to legit po. Logsource: windows / network_connection. Rule: title: New Connection Initiated To Potential Dead Drop Resolver Domain id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 related: - id: d7b09985-95a3-44be-8450-b6eadf49833e type: obsolete - id: 8b48ad89-10d8-4382-a546-50588c410f0d type: similar - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar status: test description: 'Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected. ' references: - https://web.archive.org/web/20220830134315/https://content.fireeye.com/apt-41/rpt-apt41/ - https://securelist.com/the-tetrade-brazilian-banking-malware/97779/ - https://blog.bushidotoken.net/2021/04/dead-drop-resolvers-espionage-inspired.html - https://github.com/kleiton0x00/RedditC2 - https://twitter.com/kleiton0x7e/status/1600567316810551296 - https://www.linkedin.com/posts/kleiton-kurti_github-kleiton0x00redditc2-abusing-reddit-activity-7009939662462984192-5DbI/?originalSubdomain=al author: Sorina Ionescu, X__Junior (Nextron Systems) date: 2022-08-17 modified: 2026-03-29 tags: - attack.command-and-control - attack.t1102 - attack.t1102.001 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: - .t.me - 0x0.st - 4shared.com - abuse.ch - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - cloudflare.com - ddns.net - discord.com - docs.google.com - drive.google.com - dropbox.com - dropmefiles.com - facebook.com - feeds.rapidfeeds.com - fotolog.com - ghostbin.co/ - githubusercontent.com - gofile.io - hastebin.com - imgur.com - livejournal.com - mediafire.com - mega.co.nz - mega.nz - onedrive.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - pixeldrain.com - privatlab.com - privatlab.net - reddi