Kali365 / EvilTokens - Sign-in from Suspicious Proxy IPs
Detects sign-ins from additional IP ranges associated with Kali365 infrastructure and proxies, which could indicate token replay attacks or other unauthorized access attempts.
Microsoft Sentinel (KQL)
