Detections tagged with T1199

Jan 25, 2025 Azure AD - App/OAuth: Admin Consented to Risky API Permissions on Behalf of the Organization
#KQL#Sentinel#AzureAD#OAuth#AuditLogs#T1199