From ffe4b1cbe95cd8607fe774f26c8cc645a80645c8 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 22 Aug 2024 18:26:06 +0530 Subject: [PATCH] remove city from decription --- .../cloud/azure_ad_concurrent_sessions_from_different_ips.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml index f76c0c237e..2c5ac52377 100644 --- a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml @@ -8,8 +8,7 @@ type: TTP description: The following analytic detects an Azure AD account with concurrent sessions originating from multiple unique IP addresses within a 5-minute window. It leverages Azure Active Directory NonInteractiveUserSignInLogs to identify this behavior by - analyzing successful authentication events and counting distinct source IPs and cities per - user. This activity is significant as it may indicate session hijacking, where an + analyzing successful authentication events and counting distinct source IPs. This activity is significant as it may indicate session hijacking, where an attacker uses stolen session cookies to access corporate resources from a different location. If confirmed malicious, this could lead to unauthorized access to sensitive information and potential data breaches.