[Rule Tuning] Expanding coverage for First Occurrence of Entra ID Auth via DeviceCode Protocol#4466

terrancedejesus merged 7 commits intomainelastic/detection-rules:mainfrom

rule-tuning-azure-entra-id-sign-in-device-code-phishingelastic/detection-rules:rule-tuning-azure-entra-id-sign-in-device-code-phishingCopy head branch name to clipboard