Suspicious Acquisition and Use of Application-Specific Passwords
Detects the creation of application-specific passwords followed by their initial use from unknown or new IP addresses using legacy authentication clients, which may indicate account compromise or persistence establishment.
Microsoft Sentinel (KQL)
