At least one Microsoft Defender for Cloud Apps anomaly detection policy is generating alerts
Overview
Section titled “Overview”Microsoft Defender for Cloud Apps includes anomaly detection policies that baseline each user’s behavior and surface deviations such as impossible travel, activity from an infrequent country, activity performed by a terminated user, and unusual file download, share, or delete volume. When no anomaly detection policy is producing alerts, a threat actor who compromises a credential and exfiltrates from a software-as-a-service app operates in the same telemetry surface as the legitimate user, and the security team has no signal that the behavior is anomalous. This check confirms that anomaly detection is active and producing alerts so credential-based attacks against cloud apps surface in the incident queue rather than completing silently.
Remediation
Section titled “Remediation”- Get behavioral analytics and anomaly detection
- Tune anomaly detection policies
- Connect apps to get visibility and control
- Best practices for protecting your organization with Microsoft Defender for Cloud Apps
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | SaaS threat detection |
| Product | Defender |
| Feature | Tenant settings |
| Area | Logging and detection |
| ATT&CK | T1078.004 Cloud Accounts |
| Licence | ADALLOM_S_STANDALONE, ADALLOM_S_O365 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.