MediumMicrosoft Sentinel analytics Microsoft Security Research

Privileged User Logon from new ASN

Detects a successful logon by a privileged account from an ASN not logged in from in the last 14 days. Monitor these logons to ensure they are legitimate and identify if there are any similar sign ins.

Detection logic

Detection requirements

Platform: IaaS Identity Provider Office Suite SaaS
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: azureactivedirectory behavioranalytics
Log source service: behavioranalytics identityinfo signinlogs

Detection rules

Privileged User Logon from new ASN

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules