Anomalous User Activity Detected by Azure AD Identity Protection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•30

This rule detects anomalous user activity patterns, specifically focusing on suspicious changes to directories or other behaviors that Microsoft Entra ID Protection identifies as 'anomalousUserActivity'. This could indicate compromised accounts or insider threats.