ROPC Client ID Brute Forcing via MFA Sweep

Anders Kristiansen@Pelsebubben

•updated Jun 26, 2025•10•5•167

This detection targets suspicious ROPC (Resource Owner Password Credentials) authentication attempts involving brute-forcing of application client IDs, specifically related to the `Invoke-BruteClientIDs` function in MFA Sweep. This function can be used for enumerating gaps in MFA and/or CA policies, in addition to password validation via credential stuffing.