Jingle Thief Rogue Device or MFA Registration from Morocco
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco or associated with specific Moroccan ASNs. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
Sigma
