Interactive Sign-In by Sync_ Prefixed Entra Connect Account
Detects interactive sign-in by an Entra Connect/AAD Connect sync service account (Sync_ prefix), which should only authenticate non-interactively. CISA's red team compromised a hybrid sync account to pivot from on-prem AD into cloud resources.
Microsoft Sentinel (KQL)
