Predictable Username Pattern Enumeration Across Multiple Entra Tenants
This rule detects potential user enumeration attacks targeting Entra ID tenants by monitoring for failed sign-in attempts (ResultType 50034) involving common, predictable username patterns across multiple tenants within a 24-hour window. This behavior often indicates an adversary attempting to map valid usernames by exploiting error code differences or identity discovery patterns.
Sigma
