http://www.kitploit.com/2022/01/mandiant-azure-ad-investigator.html
Mandiant-Azure-AD-Investigator - PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity