M365 password spray followed by successful sign-in and privileged persistence
Detects a potential password spraying attack characterized by multiple authentication failures across numerous users from a single IP address, followed by a successful sign-in from that same IP, culminating in a privileged role or credential change performed by the compromised account.
Microsoft Sentinel (KQL)
