Todyl Reported Malicious Workload Identity Authentication IOC
This threat hunting query identifies Microsoft Entra ID workload identity authentication activity originating from 199.19.77.84, an IP address publicly reported by Todyl during an investigation into unauthorized access leveraging compromised application credentials and service principals.
Microsoft Sentinel (KQL)
