VerdantBamboo M365 Auth via Non-Compliant Device Bypassing Conditional Access
Detects Microsoft 365 sign-in patterns indicative of an adversary bypassing Conditional Access device compliance requirements using an edge appliance proxy. The rule identifies successful authentication sessions from non-compliant or unmanaged devices that satisfy Conditional Access, often involving impossible travel or multiple source IPs, suggesting the use of an intermediary infrastructure to masquerade as a trusted location.
Microsoft Sentinel (KQL)
