diff --git a/azureEventHub_entra.rules b/azureEventHub_entra.rules
index ed4f1a48..a6cded94 100644
--- a/azureEventHub_entra.rules
+++ b/azureEventHub_entra.rules
@@ -53,4 +53,4 @@ alert any $HOME_NET any -> $HOME_NET any (msg:"[AZURE-EVENTHUB-ENTRA] High level
 alert any any any -> any any (msg:"[AZURE-EVENTHUB-ENTRA] User Risk Detected - Details Hidden"; program:azureEventHub; json_content:".operationName","User Risk Detection"; meta_content:"%sagan%",UnfamiliarASN,UnfamiliarIP,UnfamiliarLocation,UnfamiliarDevice; json_content:".properties.riskDetail","hidden"; json_map:"src_ip",".callerIpAddress"; classtype:initial-access; reference:url,https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks; reference:url,https://support.blumira.com/hc/en-us/articles/45766986695571-Investigating-Azure-Identity-Protection-Risky-Sign-in-findings; sid:5017924; rev:1; metadata: createdOn 2026_05_18, updatedOn 2026_05_18, mitreTacticID TA0001, mitreTacticName InitialAccess, mitreTechniqueID T1078.004, mitreTechniqueName ValidCloudAccounts;)
 
 # [truncated for JSON_MAX_KEY_SIZE=32 engine limit -- legacy engine stores keys clipped to 31 chars, full path never matches] .properties.originalTransferMethod -> .properties.originalTransferMet; .properties.deviceDetail.isManaged -> .properties.deviceDetail.isMana
-alert any $HOME_NET any -> $HOME_NET any (msg:"[AZURE-EVENTHUB-ENTRA][EXPERIMENTAL] Non-Interactive Refresh Token Replay via Device Code Flow on Unmanaged Device"; program:azureEventHub; json_content:".category","NonInteractiveUserSignInLogs"; json_content:".resultType","0"; json_content:".properties.originalTransferMet","deviceCodeFlow"; json_content:".properties.appDisplayName","Microsoft Authentication Broker"; json_content:!".properties.deviceDetail.isMana","true"; json_nocase; reference:url,learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code; reference:url,attack.mitre.org/techniques/T1550/001; classtype:trojan-activity; parse_src_ip: 1; threshold: type limit, track by_src, count 1, seconds 86400; sid:5017933; rev:1; metadata:deployment Server,affected_product Microsoft_Entra,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2026_06_26, updated_at 2026_06_26, mitre_tactic_id TA0005, mitre_technique_id T1550.001;)
+alert any $HOME_NET any -> $HOME_NET any (msg:"[AZURE-EVENTHUB-ENTRA] Non-Interactive Refresh Token Replay via Device Code Flow on Unmanaged Device"; program:azureEventHub; json_content:".category","NonInteractiveUserSignInLogs"; json_content:".resultType","0"; json_content:".properties.originalTransferMet","deviceCodeFlow"; json_content:".properties.appDisplayName","Microsoft Authentication Broker"; json_content:!".properties.deviceDetail.isMana","true"; json_nocase; reference:url,learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code; reference:url,attack.mitre.org/techniques/T1550/001; classtype:trojan-activity; parse_src_ip: 1; threshold: type limit, track by_src, count 1, seconds 86400; sid:5017933; rev:2; metadata:deployment Server,affected_product Microsoft_Entra,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2026_06_26, updated_at 2026_08_27, mitre_tactic_id TA0005, mitre_technique_id T1550.001;)