TruffleHog User-Agent in Azure AD Sign-in Logs
This rule detects sign-in attempts to Azure AD where the User-Agent string contains 'TruffleHog'. TruffleHog is an open-source tool used for finding sensitive data like credentials in various data sources, including code repositories. Its presence in sign-in logs could indicate an adversary or security researcher attempting to verify leaked credentials or discover exposed secrets related to Azure AD service principals.
Microsoft Sentinel (KQL)
