Kali365 - Widespread Token App Reuse (T1528)
Identifies the compromised session token being reused rapidly across Exchange Online, SharePoint, and Teams from a single IP to harvest data. This rule detects when a single account object ID and IP address access 3 or more distinct applications within a 5-minute window, which could indicate the reuse of a compromised token.
Microsoft Sentinel (KQL)
