LSHIY - Azure CLI Sign-In by Non-Admin User via python-requests Agent

Ethan Andrews@eandrews

•updated Jul 1, 2026•13•0•23

Detects non-interactive sign-ins to Azure CLI using the 'python-requests' User-Agent by non-administrative users. This pattern is associated with the LSHIY password spray campaign, which exploits the OAuth ROPC flow for credential abuse against Microsoft 365.