M365 mailbox access from new IPs after password reset without token revocation
Detects scenarios where a user's password is reset or sessions are revoked in Azure Active Directory, followed closely by mailbox access (items accessed, sent, or deleted) from a client IP address that was never seen interacting with that mailbox prior to the password reset event.
Splunk (SPL)
