Correlation - Burst Pattern of Anomalously High-Volume Entra Sign-In Events

Duo Tech@duotech

•updated Jul 14, 2026•0•0•2

Detects short-window spikes in Entra sign-in/token-request event volume (exceeding roughly 100,000-250,000 events within a single day per tenant), consistent with automated client-ID-spoofed ROPC enumeration campaigns that exhibit a multi-day burst-then-quiet cadence.