Storm-0940 High-Volume Password Spray Against M365

Kaung Khant Ko@kaungkhantko

•updated today•10•0•13

This rule detects high-volume password spraying activity against Microsoft Entra ID (M365) sign-ins. It utilizes two detection branches: a behavioral branch identifying single source IPs generating massive failed sign-ins and lockouts across multiple accounts, and an indicator-based branch flagging known Storm-0940 infrastructure or specific scripted user agents performing rapid authentication attempts.