Sign-ins from Malicious IPs with Valid Credentials or Token Claims
This KQL detection rule identifies suspicious login attempts in the SigninLogs dataset where a sign-in was blocked because it originated from an IP address flagged for malicious activity. The rule specifically focuses on cases where valid credentials or token claims were used during the authentication process.
Microsoft Sentinel (KQL)
