Entra Service Principal Sign-Ins From Stolen App Credentials Hunt
Hunts Entra ID service principal sign-ins that match reported stolen app credential abuse against MSP and customer tenants: the reported operator IP and client strings, an invalid secret followed by a successful sign-in from the same IP and apps that sign in for the first time in the window. It matches reported indicators only, so other infrastructure is not covered.
Microsoft Sentinel (KQL)
