Reconnaissance sign-ins to mysignins/myaccount.microsoft.com
This rule identifies successful user sign-in events specifically targeted at Microsoft's management portals (myaccount.microsoft.com and mysignins.microsoft.com). It aggregates these events by user, tracking the frequency, timeframe, and originating IP addresses for successful access. This monitoring is useful for detecting abnormal access to identity settings, which could indicate credential abuse or unauthorized account management.
Microsoft Sentinel (KQL)
