UWP/Store App AAD Broker Loopback Exempt
This rule detects the execution of 'CheckNetIsolation.exe' with the command-line arguments 'LoopbackExempt' and 'aad'. This specific command is used to exempt Universal Windows Platform (UWP) or Store apps from network loopback restrictions, often in the context of Azure Active Directory (AAD) authentication. While this can be a legitimate operation for development or specific application configurations, it can also be abused by malicious applications to bypass network isolation.
Microsoft Sentinel (KQL)
