Malicious IP Address Sign-In Failure Rate
This rule detects sign-in attempts originating from IP addresses identified as malicious by Azure AD Identity Protection, specifically when these attempts are characterized by a high failure rate. This indicates potential brute-force attacks, credential stuffing, or other unauthorized access attempts from known bad IP addresses.
Sigma
