Azure CLI Non-Interactive Access After Interactive Login
This rule detects suspicious activity where an Azure CLI session, initially interactive, is followed by non-interactive access from a different IP address. This could indicate an attacker using a stolen token or session from a legitimate user's interactive login to perform automated actions. The rule specifically looks for a pivot from interactive to non-interactive access where the non-interactive access occurs after the interactive access and from a different IP address, within a 30-day lookback window.
Microsoft Sentinel (KQL)
