Successful Azure AD Sign-in from Suspicious User-Agent Outside ANZ
This rule detects successful sign-ins to Azure Active Directory (AAD) from IP addresses outside of Australia and New Zealand, where the User-Agent string matches a list of known suspicious User-Agents. It filters out many legitimate User-Agents to reduce false positives, including those from Microsoft applications, mobile devices, and common tools.
Microsoft Sentinel (KQL)
