Entra ID Sign-In Using Valid-Format UUIDv4 Client ID With No Registered Application Name
Detects Microsoft Entra ID sign-in events where the AppId (OAuth client_id) is a syntactically valid UUIDv4 but no corresponding AppDisplayName is populated, indicating the client ID does not correspond to any registered enterprise application in the tenant. This pattern is consistent with randomly generated, valid-format spoofed client IDs used in ROPC-based username/password enumeration.
Sigma
