Scoped EvilToken phishing hunt
National_SigninLogs
 where TimeGenerated  ago(7d)// <-- Alter the number/letter combination here for different time periods - (e.g, 24h, 1m, 7d, 1w etc.)
	and AuthenticationProtocol == deviceCode
 where not(IPAddress matches regex @"specific.ip.that.was.redacted") //<-- IP address goes here. Each "." character must have a \ before it (e.g 10\.10\.10\.50)
 join kind= inner (National_IdentityInfo
     where TimeGenerated = ago (30d)
     where OnPremisesDistinguishedName contains_cs "HDDPATH" //<-- Enter desired OU path here
     project AccountDisplayName, AccountObjectId
    )
    on $left.UserId == $right.AccountObjectId
 summarize any(TimeGenerated, Identity, UserPrincipalName, AuthenticationProtocol, ResultSignature, IPAddress, AppDisplayName, AuthenticationRequirement, ClientAppUsed, ConditionalAccessStatus, IsInteractive, LocationDetails, UserAgent) by CorrelationId
 project TimeGenerated=any_TimeGenerated, Identity=any_Identity, UserPrincipalName=any_UserPrincipalName, AuthenticationProtocol=any_AuthenticationProtocol, ResultSignature=any_ResultSignature, IPAddress=any_IPAddress, AppDisplayName=any_AppDisplayName, AuthenticationRequirement=any_AuthenticationRequirement, ClientAppUsed=any_ClientAppUsed, ConditionalAccessStatus=any_ConditionalAccessStatus, IsInteractive=any_IsInteractive, LocationDetails=any_LocationDetails, UserAgent=any_UserAgent

IP: 192.64.104.25
Time: 12h
OU Path: LeagueofLegends/Mages/Littebitches/Veigar