AAD Connect Sync Account Sign-in to Non-Azure AD Connect App
Detects successful sign-ins by accounts that appear to be Azure AD Connect synchronization service accounts (e.g., 'MSOL_', 'Sync_', 'AADConnect') but are not initiating from the expected Microsoft Azure Active Directory Connect application. This may indicate an adversary attempting to use these highly privileged service accounts for unauthorized access or lateral movement.
Microsoft Sentinel (KQL)
