Static credential or token reuse from new source IP without MFA
Detects service principal or non-interactive user sign-ins from an IP address not seen for that identity in the previous 14 days, with multiple successful sign-ins or accessed resources. This behavior may indicate compromised static credentials or secrets used for persistence or lateral movement without MFA.
Microsoft Sentinel (KQL)
