Entra ID password spraying from one source IP across many accounts and countries
Detects potential password spraying behavior in Entra ID sign-in logs, characterized by a single source IP attempting authentication against numerous distinct user accounts with a low number of attempts per user.
Splunk (SPL)
