Entra ID Username Enumeration via AADSTS50034 Error Response
Detects potential username enumeration attempts against Microsoft Entra ID (Azure AD) by monitoring for the 'AADSTS50034' error code, which occurs when a sign-in attempt is made with a username that does not exist in the directory. This behavior is often associated with adversary reconnaissance to identify valid user accounts.
Sigma
