High-cardinality client ID rotation from a single source IP
Detects high-volume, anomalous authentication failure patterns originating from a single IP address, characterized by a large number of distinct applications and users accessed within a one-hour window. This is indicative of potential automated credential-based attacks such as password spraying or brute force.
Microsoft Sentinel (KQL)
