High-Volume Entra Sign-In Enumeration Without Successful Authentication
Detects high volumes of sign-in failures originating from the same IP address, specifically those returning error codes associated with invalid users or incorrect passwords, which is indicative of credential stuffing or user enumeration attacks targeting Entra ID.
Sigma
