LSHIY Password Spray via Azure CLI ROPC from IPv6 Range 2a0a:d683::/32
Detects high-volume password spraying attempts targeting Microsoft 365, originating from the LSHIY LLC IPv6 address space (2a0a:d683::/32). The rule monitors for failed sign-ins using the OAuth ROPC flow via Azure CLI or similar tools, identifying high counts of distinct accounts targeted within a short time frame.
Microsoft Sentinel (KQL)
