Storm-0940 ARTEX password spray followed by OAuth app credential abuse
Detects a password spray attack pattern (characterized by multiple failed authentication attempts across numerous distinct accounts from a single source IP or known Storm-0940 IPs) followed by successful sign-ins and subsequent credential additions or role assignments to OAuth applications or service principals within a 6-hour window.
Microsoft Sentinel (KQL)
