Axios/Undici User Agent Sign-in
Detects sign-ins to Entra ID using Axios, Undici, or Node-Fetch user agents, which are fingerprints of Tycoon 2FA attacks. This rule helps identify potential multi-factor authentication bypass attempts.
Microsoft Sentinel (KQL)
