Anomalous Azure AD Service Principal Sign-In via Scripting User Agent

Lacey Cochrane@NullVectorX

•updated 10 days ago•5•0•7

Detects Azure AD service principal sign-ins utilizing suspicious scripting-related user agents such as curl, python-requests, Wget, or Postman, which may indicate automated scripting, custom tooling, or potential abuse of cloud service accounts.