AddedCredentialFromContryXAndSigninFromCountryY
Added credential from country X and Signed-In from country Y in a pecific time window: This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
Microsoft Sentinel (KQL)
