Credential stuffing: one source IP failing across many accounts then succeeding
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
Microsoft Sentinel (KQL)
