Query: rule covering Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microso
Matching passage: Sigma rule: Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microso. Logsource: m365 / threat_detection. Rule: title: Activity from Suspicious IP Addresses id: a3501e8e-af9e-43c6-8cd6-9360bdaae498 status: test description: 'Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account. ' references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1573 logsource: service: threat_detection product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Activity from suspicious IP addresses status: success condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: CurrentVersion NT Autorun Keys Modification id: cbf93e5d-ca6c-4722-8bea-e9119007c248 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_nt_current_version_base: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion selection_nt_current_version: TargetObject|contains: - \Winlogon\VmApplet - \Winlogon\Userinit - \Winlogon\Taskman - \Winlogon\Shell - \Winlogon\GpExtensions - \Winlogon\AppSetup - \Winlogon\AlternateShells\AvailableShells - \Windows\IconServiceLib - \Windows\Appinit_Dlls - \Image File Execution Options - \Font Drivers - \Drivers32 - \Windows\Run - \Windows\Load filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_poqexec: Image: C:\Windows\System32\poqexec.exe filter_main_legitimate_subkey: TargetObject|contains: \Image File Execution Options\ TargetObject|endswith: - \DisableExceptionChainValidation - \MitigationOptions filter_main_security_extension_dc: Image: C:\Windows\system32\svchost.exe TargetObject|contains: - \Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\PreviousPolicyAreas - \Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\MaxNoGPOListChangesInterval Details: - DWORD (0x00000001) - DWORD (0x00000009) - DWORD (0x000003c0) filter_main_runtimebroker: Image: C:\Windows\System32\RuntimeBroker.exe TargetObject|contains: \runtimebroker.exe\Microsoft.Windows.ShellExperienceHost filter_optional_edge: Image|startswith: C:\Program Files (x86)\Microsoft\Temp\ Image|endswith: \MicrosoftEdgeUpdate.exe filter_optional_avguard: Image|startswith: - C:\Program Files (x86)\Avira\Antivirus\avguard.exe - C:\Program Files\Avira\Antivirus\avguard.exe TargetObject|contains: SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentV