Expired Entra ID Refresh Token Use Attempt
This rule identifies attempts to use expired or revoked OAuth refresh tokens to sign in to Entra ID (formerly Azure AD). This could indicate an adversary attempting to use a previously compromised token that is no longer valid, or a legitimate user whose token has expired due to inactivity (90 days) or revocation. The rule specifically looks for login events from 'Azure Activity' with a 'BLOCK' action and an action detail code of '50173', which corresponds to an expired or invalid refresh token.
YARA-L
