AAD Password Spray: 10+ Unique Users Failed from Same IP in 10min
Detects high-frequency authentication failure events targeting multiple unique user accounts from the same source IP address within a 10-minute window. This behavior is indicative of password spraying or credential stuffing attacks against Azure Active Directory (Microsoft Entra ID). The rule specifically monitors for common error codes related to incorrect passwords or account lockout conditions.
Microsoft Sentinel (KQL)
