All Detections

Kali365 / EvilTokens - Python-Requests Egress to MS Graph

avatar
Ibrahim Saud@tektrix
updated Jun 20, 2026309

Identifies python-requests User-Agent authenticating into Office/Graph applications, indicative of Kali365 backend egress.

Microsoft Sentinel (KQL)