Detects possible search for office tokens via CLI by looking for the string "eyJ0eX". This string is used as an anchor to look for the start of the JWT token used by office and similar apps.

Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.

Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)

Detects URL pattern used by iOS Implant

Detects creation of default named pipes used by the Koh tool

Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Detects when highly privileged delegated permissions are granted on behalf of all users

Detects when an end user consents to an application

Detects when end user consent is blocked due to risk-based consent.

Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.

Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.