LSHIY Password Spray - Successful Compromise After Azure CLI Mass Failures
This rule detects successful Azure AD sign-in events (ResultType 0) that occur following a series of repeated failed sign-in attempts (ResultType 50126) from the same user account. The activity is specifically scoped to the LSHIY IPv6 address range and utilizes Azure CLI or similar mobile/desktop client applications, which is a strong indicator of an automated password spraying or credential stuffing attack followed by a successful compromise.
Microsoft Sentinel (KQL)
