Non-Interactive Sign-in Burst from Cloud VPS
Detects rapid non-interactive sign-ins utilizing refresh tokens from known VPS hosting providers. This rule identifies a high volume of successful non-interactive sign-ins (more than 20 within a 10-minute window) from a single user and IP address, indicating potential abuse of refresh tokens, possibly from a compromised cloud VPS.
Microsoft Sentinel (KQL)
