Password Spray or Brute Force Success Pattern Detected
This rule detects a pattern indicative of password spraying or brute force attacks against user accounts. It identifies instances where a single user principal name (UPN) and IP address combination has at least 5 failed sign-in attempts and at least 1 successful sign-in attempt within a 30-minute window. This combination of failed and successful logins from the same source for the same user suggests an attacker successfully guessed a password after multiple attempts, or a password spraying attack where one of the sprayed passwords was correct.
Microsoft Sentinel (KQL)
