yara-lApache-2.0from chronicle/detection-rules
entra_id_login_activity_to_azure_ad_powershell_app
Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programatic access to Azure AD should generally be through other apps
Quality
98
FP risk
—
Forks
0
Views
0
Rule source🔒 locked
🔒
Sign in to view the rule source
Free accounts can view the source for the top-ranked rules. Create one in seconds — no credit card required.
Sign in →