Merge PR #5511 from @gregorywychowaniec-zt - add null condition in addition to empty string

update: Suspicious SignIns From A Non Registered Device - add null value in addition to empty string
---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

Author: gregorywychowaniec-zt

rules/cloud/azure/signin_logs/azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml

@@ -6,19 +6,23 @@ references:
     - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
 author: Harjot Singh, '@cyb3rjy0t'
 date: 2023-01-10
+modified: 2025-07-02
 tags:
     - attack.defense-evasion
     - attack.t1078
 logsource:
     product: azure
     service: signinlogs
 detection:
-    selection:
+    selection_main:
         Status: 'Success'
         AuthenticationRequirement: 'singleFactorAuthentication'
-        DeviceDetail.trusttype: ''
         RiskState: 'atRisk'
-    condition: selection
+    selection_empty1:
+        DeviceDetail.trusttype: ''
+    selection_empty2:
+        DeviceDetail.trusttype: null
+    condition: selection_main and 1 of selection_empty*
 falsepositives:
     - Unknown
 level: high