Primary Refresh Token Access Attempt — Detection Rule

Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft

Read the full analysis on IntelFusions