CoPhish detection
Detects users who accessed Microsoft Copilot Studio and correlates that activity with OAuth consent events for third-party applications in Azure Active Directory. Optionally, it verifies whether the consented application was used to access data via Microsoft Graph API, indicating potential account compromise.
Microsoft Sentinel (KQL)
