SMTP Brute Force Attempts Detected
This rule detects a high volume (50 or more) of failed authenticated SMTP login attempts to Office 365 Exchange Online from a single IP address within a 24-hour period. The failures are specifically for error codes 50126 (invalid username or password) or 50053 (account locked). This pattern is indicative of a brute-force or password-guessing attack against Exchange Online accounts.
Microsoft Sentinel (KQL)
