Anomalous sign-in user-agent/OS mismatch and Outlook client spoofing (Storm-2755)
Detects sign-ins with impossible browser/OS combinations and Outlook-labeled sign-ins presenting non-native user agents, consistent with Storm-2755 AiTM session token replay and impersonation.
Microsoft Sentinel (KQL)
