Connection to Malicious Auth Brokers (DPRK jupyter-powerdev)
Identifies network connections to specific Azure-hosted authentication brokers used by the jupyter-powerdev malware to retrieve Graph API tokens for its SharePoint C2 channel. This rule specifically looks for connections to known malicious broker domains or a known associated IP address.
Microsoft Sentinel (KQL)
