Successful Logon Following Failed Brute-Force Attempts (VPN/Identity)
This rule monitors for successful sign-in events that follow a threshold of failed authentication attempts within a one-hour window, specifically flagging cases where the successful login originated from a new location or a previously unseen device, which is often indicative of successful brute force or password spraying attacks.
Microsoft Sentinel (KQL)
