Files
sigma-rules/rules/integrations/azure
Terrance DeJesus e3a7ee94fc [Rule Tuning] Microsoft Entra ID Suspicious Session Reuse to Graph Access (#4954)
* adjusted query

* add keep; lint

* Update rules/integrations/azure/initial_access_entra_graph_single_session_from_multiple_addresses.toml

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>

---------

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
2025-08-13 17:41:58 -04:00
..