Stolen App Secret Campaign: Operator IP and Actor User Agents in Entra Sign-ins
Hunt: Entra sign-ins from the operator IP, or with the two client fingerprints Todyl reports as unique to this actor. These are the highest-confidence indicators in the campaign, so a successful hit means a stolen app secret worked in your tenant. The low-confidence spray IPs are off by default; enable them only for hunting, since a hit there indicates targeting, not compromise.
Microsoft Sentinel (KQL)
