PRT Non-Interactive Sign-in from New Device After Risky/AiTM Sign-in
Detects non-interactive sign-in activity using a Primary Refresh Token (PRT) occurring shortly after a risky or AiTM-flagged interactive sign-in for the same user, originating from a device that has not been previously associated with that user account.
Microsoft Sentinel (KQL)
