PUSH - Protected Password Used on Non-SSO Application
This rule detects instances where a user enters a protected password into an application that has not been configured or registered for SSO (Single Sign-On). It achieves this by identifying 'Protected password entered' events and using a join-anti operation to filter out sessions where an 'SSO_PASSWORD_USED' event was previously recorded for the same user and domain.
Microsoft Sentinel (KQL)
