OAuth Login from Residential Proxy
This rule detects successful OAuth logins originating from IP addresses identified as residential proxies. This behavior can indicate an adversary attempting to bypass geo-restrictions or obscure their true location, potentially as part of a credential stuffing attack, account takeover, or to evade detection.
Microsoft Sentinel (KQL)
