Compromised Cloud Credential Login Followed by Privilege Escalation
This rule detects a correlation between a successful user login from an IP address not previously seen for that specific user in the last 14 days, followed immediately (within 1 hour) by sensitive administrative operations performed by the same user, such as adding members to roles or modifying application permissions.
Microsoft Sentinel (KQL)
