ROPC Sign-In with Spoofed Client ID and Blank Application Name
Detects Microsoft Entra ID sign-in events using the Resource Owner Password Credentials (ROPC) flow where the client application displays a blank name. This pattern is commonly associated with attackers spoofing OAuth client IDs to bypass security controls or perform user enumeration.
Sigma
