Elastic critical stable kql

Entra ID Protection Admin Confirmed Compromise

Identifies when an administrator has manually confirmed a user or sign-in as compromised in Microsoft Entra ID Protection. This indicates that an administrator has reviewed the risk detection and determined that the user account or sign-in activity is definitively compromised. This is a high-confidence indicator of account compromise and should be investigated immediately.

View Source

Detection Logic

data_stream.dataset: azure.identity_protection and
    azure.identityprotection.properties.risk_detail: (
        "adminConfirmedSigninCompromised" or
        "adminConfirmedUserCompromised"
    )

False Positives

  • ⚠ Administrators may mark accounts as compromised during security testing or incident response exercises. If this is expected behavior in your environment, consider adjusting the rule or adding exceptions for specific test accounts.

Field Validations

Loading…

Comments (0)

Loading comments...