Detection rules › By event

M365-MCASAlerts

Event	Rules
any	1
Activity from anonymous IP addresses	1
Activity from infrequent country	1
Activity from suspicious IP addresses	1
Activity performed by terminated user	1
Data exfiltration to unsanctioned apps	1
Impossible travel activity	1
Log on from a risky IP address	1
Potential ransomware activity	1
Suspicious inbox forwarding	1
Suspicious OAuth app file download activities	1

any

1 detection rules reference this event. View event page.

Elastic (1)

M365 Defender Alerts Signal (UAL) severity medium building block

Activity from anonymous IP addresses

1 detection rules reference this event. View event page.

Sigma (1)

Activity from Anonymous IP Addresses severity medium T1573

Activity from infrequent country

1 detection rules reference this event. View event page.

Sigma (1)

Activity from Infrequent Country severity medium T1573

Activity from suspicious IP addresses

1 detection rules reference this event. View event page.

Sigma (1)

Activity from Suspicious IP Addresses severity medium T1573

Activity performed by terminated user

1 detection rules reference this event. View event page.

Sigma (1)

Activity Performed by Terminated User severity medium

Data exfiltration to unsanctioned apps

1 detection rules reference this event. View event page.

Sigma (1)

Data Exfiltration to Unsanctioned Apps severity medium T1537

Impossible travel activity

1 detection rules reference this event. View event page.

Sigma (1)

Microsoft 365 - Impossible Travel Activity severity medium T1078

Log on from a risky IP address

1 detection rules reference this event. View event page.

Sigma (1)

Logon from a Risky IP Address severity medium T1078

Potential ransomware activity

1 detection rules reference this event. View event page.

Sigma (1)

Microsoft 365 - Potential Ransomware Activity severity medium T1486

Suspicious inbox forwarding

1 detection rules reference this event. View event page.

Sigma (1)

Suspicious Inbox Forwarding severity low T1020

Suspicious OAuth app file download activities

1 detection rules reference this event. View event page.

Sigma (1)

Suspicious OAuth App File Download Activities severity medium