01
detectionlint / library / yara-l
entra_id_login_activity_to_azure_ad_powershell_app
Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programatic access to Azure AD should generally be through other apps
02
quality98
fp risk—
forks0
views0
rule sourcelocked
Sign in to view the rule source
Free accounts can view the source for the top-ranked rules. Create one in seconds — no credit card required.
Sign in