ROADtools Azure Active Directory Reconnaissance
Identifies potential use of ROADtools for Azure AD reconnaissance by monitoring for Azure CLI/PowerShell App IDs coupled with a Python user agent in sign-in logs. This rule specifically looks for sign-ins to 'Windows Azure Active Directory' resource where the user agent string contains 'python' or the device detail string contains 'Python', and the App ID or App Display Name matches known Azure AD PowerShell or Azure CLI applications.
Microsoft Sentinel (KQL)
