Azure AD Sign-in from Unknown Device and Location
This rule detects sign-in attempts to Azure AD where the authentication requirement was single-factor, the sign-in was successful (ResultType: 0), the network location details were empty (indicating an unknown or unclassified location), and the device ID was also empty (indicating an unknown or unregistered device). This combination suggests a sign-in from an unknown device and potentially an untrusted location, which could be indicative of an adversary attempting to gain initial access or maintain persistence.
Sigma
