Entra ID Conditional Access Bypass via Spoofed OAuth Client ID
Detects sign-in events where a sign-in attempt is performed with a valid application ID but contains a blank application name, indicating potential spoofing of an OAuth client to bypass Conditional Access policies. The rule specifically monitors instances where Conditional Access status is recorded as 'notApplied'.
Sigma
