Password Spraying Attack on Entra ID
This rule detects potential password spraying attacks against Microsoft Entra ID (formerly Azure Active Directory). It identifies a high number of failed sign-in attempts from a single source IP address targeting multiple unique user accounts within a short timeframe, specifically looking for 'Invalid password' or 'invalid credentials' failure reasons. The thresholds are set to 20 or more failures and 10 or more unique users within a 5-minute window.
Microsoft Sentinel (KQL)
