PREY-0058 post-compromise sign-in app sequence (My Signins/My Profile/My Apps)
Detects a suspicious sequence of interactive sign-ins to Microsoft management and profile-related applications from unmanaged devices occurring within a tight 15-minute window. This behavior is indicative of post-compromise activity, potentially associated with activity clusters such as UNC6671, where an attacker interacts with account settings shortly after compromising a session.
Microsoft Sentinel (KQL)
