Service Principal Sign-in from New IP After Established Baseline (Stolen Secret

ills3c Intel&Coffee@Ills3C

•updated today•0•0•2

Detects non-interactive service principal sign-ins originating from an IP address and location never seen for that specific principal over a prior 30-day baseline period, approximating potential misuse of stolen cloud credentials exposed via environment variables.