File Creation or Deletion in Token Cache Folders
This detection monitors for the creation or deletion of files within the TokenBroker and AAD Broker Plugin cache folders. These folders store authentication tokens that, if accessed or manipulated by an unauthorized process, could indicate credential theft activity.
Microsoft Sentinel (KQL)
