Detect roadrunner/ AD Graph via Company Portal app

gistfile1.txt

AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(30d)
// Filter for Company portal
| where AppId == "9ba1a5c7-f17a-4de9-a1f1-6178c8d51223"
// Filter for the Windows Azure AD api
| where ResourceIdentity == "00000002-0000-0000-c000-000000000000" 
| extend parseddevice = parse_json(DeviceDetail)
// Filter for devices without DeviceID (those are non joined devices, likely an attacker)
| where isempty(parseddevice.deviceId)
// Filter operating systems or devices in the enviroment which are known non joined
// | where parseddevice.operatingSystem !contains ""
// Filter known good accounts or other stuff here
// | where Identity !contains ""