Sign-in to developer/cloud AI account from credential-theft-associated IP with corroborating risk signal
Detects sign-ins to developer or cloud AI accounts originating from IP addresses listed in the Unit 42 'AI Token Jacking' article's Indicators of Compromise table (117.72.74.48, 207.246.106.162, 23.236.182.215, 95.214.112.26), excluding known corporate VPN/proxy egress ranges, and correlated with at least one additional risk signal (new device, impossible travel, or off-hours access).
Microsoft Sentinel (KQL)
