A small, growing collection of KQL hunting queries for detecting identity-layer threats in Microsoft Entra ID (Azure AD), runnable in Microsoft Sentinel and adaptable to Microsoft Defender XDR ...