Password spraying followed by OAuth app consent or creation (Storm-0940 ARTEX)
Detects a behavioral pattern where a single source IP performs a password spray or brute-force attack against multiple accounts and tenants in Entra ID, followed by a successful login and subsequent OAuth application consent or creation by the affected user account.
Microsoft Sentinel (KQL)
