Suspicious Windows Admin Center Virtual Account Logon from External Tenant

nomit vyas@xoxo

•updated Jun 23, 2026•0•0•5

This rule detects logon events from Windows Admin Center (WAC) virtual accounts where the associated user principal name (UPN) belongs to an external or unknown tenant. This activity is a key indicator of compromise for CVE-2026-20965, where an attacker uses a forged token from an external tenant to gain unauthorized access.