yara-lApache-2.0from chronicle/detection-rules
o365_login_activity_to_azure_ad_powershell_app
Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programmatic access to Entra ID (Azure AD) should generally be through apps, so reviewing these activities is needed.
Quality
98
FP risk
—
Forks
0
Views
0
ATT&CK techniques
Rule source🔒 locked
🔒
Sign in to view the rule source
Free accounts can view the source for the top-ranked rules. Create one in seconds — no credit card required.
Sign in →