Enumeration via repeated AADSTS50126 invalid-username-or-password responses
This rule detects potential password spraying or brute-force activity by monitoring Azure Sign-in logs for a high volume of failed authentication attempts (error code 50126) originating from a single IP address across multiple distinct user accounts.
Microsoft Sentinel (KQL)
