Suspicious SignIns From A Non Registered Device — Detection Rule

Detects risky authentication from a non AD registered device without MFA being required.

Read the full analysis on IntelFusions