Threat hunting in Azure Advanced Threat Protection (ATP)
DART was called into an engagement where the adversary had a foothold within the on-premises network, which had been gained through compromising cloud credentials.
Microsoft Security