Anomaly detection — technical reference

Fires when two consecutive SIGN-IN events for the same user originate from countries whose geographic centroids are more than 1,000 km apart and are separated by less than 1 hour. The distance is calculated using the Haversine formula against ISO-3166-1 alpha-2 country codes. A single flag is raised on both the earlier and later event. Only interactive authentication counts as evidence of where a person was — UserLoggedIn, UserLoginFailed, SignInEvent, PasswordLogonInitialAuthUsingPassword, TeamsSessionStarted and EmailAuthOTPAuthenticationSucceeded. File and mail operations are excluded because their IP is routinely Microsoft infrastructure acting on the user behalf (background sync, indexing, mobile push), which would otherwise make every mailbox appear to teleport between datacenters. The country is resolved from the client IP against an offline database; Purview GeoLocation field is only used when it genuinely contains a country code, since for SharePoint it carries the multi-geo datacenter region instead. Indicates a credential being used from two physically incompatible locations — typically stolen credentials or a VPN/proxy masking the true origin.

Fires on every event whose UTC creation timestamp falls in the window 22:00–06:00. No user baseline is required; the rule is applied uniformly. The window is fixed in UTC to avoid timezone-dependent false negatives in global tenants. Unusually high off-hours activity — especially involving data access or deletion operations — is a common indicator of an attacker operating from a different timezone or an insider threat acting outside monitored hours.

Fires when the same user performs the same operation ≥20 times within a 60-second sliding window. A sliding-window algorithm (two-pointer) is used to avoid O(n²) complexity. If the operation belongs to the Deletion category the flag maps to T1485 (Data Destruction, Critical); otherwise it maps to T1567 (Exfiltration Over Web Service, High). Typical triggers: mass file downloads, bulk deletion of mailbox items, or automated scripts creating many sharing links.

Fires when an event with isManagedDevice === false involves a sensitive operation. Sensitive operations are: FileDownloaded, FileSyncDownloadedFull, FileSyncUploadedFull, FileRecycled, FileDeleted, AnonymousLinkCreated, SharingInvitationCreated, CompanyLinkCreated, SharingSet — or any event in the Deletion, Sharing, or Modification category. Unmanaged devices bypass Conditional Access policies and MDM controls, making them a common pivot point for both external attackers and malicious insiders.

Fires on the first SIGN-IN where a user is seen from a country not previously observed for that user in the dataset. Events are processed in chronological order; the first event from each country establishes the baseline, so only subsequent first-appearances raise a flag. It uses the same evidence rule as Impossible Travel — only interactive authentication events count, because background service access originating in a Microsoft datacenter is not the user appearing in a new country. The country is resolved from the client IP against an offline database. A single new-geography event is low signal on its own; combined with off-hours or bulk-operations flags it is a strong indicator of account compromise.

Fires the first time a user generates events attributed to an application (appDisplayName or clientAppName) not previously seen for that user in the dataset. Events are processed chronologically. The flag is not raised for the very first application a user uses — only for subsequent new ones. Attacker tooling (e.g. AADInternals, ROADtools) often authenticates as uncommon or undocumented application IDs, making this a useful low-noise signal when combined with other anomalies.

Fires the first time a user generates events from a device identifier (machineId or deviceName) not previously observed for that user in the dataset. Events are processed chronologically. The device is only considered 'new' if the user has at least one prior event on a different known device. A new device appearing alongside off-hours or impossible-travel flags strongly suggests account compromise or an attacker operating with cloned credentials on a fresh machine.

Fires when a user creates or modifies ≥5 sharing links or invitations within a 10-minute sliding window. Tracked operations: AnonymousLinkCreated, SharingSet, CompanyLinkCreated, SharingInvitationCreated, AddedToSecureLink. A two-pointer sliding window groups events per user. This pattern is characteristic of pre-exfiltration staging, where an attacker bulk-creates anonymous or guest sharing links to move data out of the tenant without triggering DLP policies designed for direct downloads.

Fires when a New-InboxRule or Set-InboxRule operation is found and the raw AuditData JSON contains any of the following keywords (case-insensitive): forwardto, forwardasattachmentto, redirectto, forwardsmssto. This heuristic detects the creation or modification of inbox rules that silently copy or redirect incoming mail to an external address — a textbook Business Email Compromise (BEC) persistence technique that survives password resets.

Fires when Set-AdminAuditLogConfig, Set-MailboxAuditBypassAssociation, or Set-OrganizationConfig is executed and the raw AuditData JSON contains disable-intent keywords such as UnifiedAuditLogIngestionEnabled, AdminAuditLogEnabledOption, AuditBypass, or JSON fields with enabled: false / adminAuditEnabled: false / mailboxAuditEnabled: false. Disabling audit logging is a defence-evasion technique used by sophisticated attackers to suppress evidence of subsequent actions.

Fires when ≥10 distinct source IP addresses generate authentication events (UserLoggedIn, UserLoginFailed, PasswordLogonInitial) within a 5-minute global sliding window across all users. The window is not user-scoped: it looks at the full tenant. A high count of distinct IPs performing authentication in a short window is the canonical signature of a password-spray attack, where the adversary rotates source IPs to evade per-IP rate limiting.