Identity Enumeration via SMTP VRFY/EXPN/RCPT TO Spray or Auth User-Not-Found Spr
This rule detects high-frequency account and email address enumeration attempts. It monitors syslog data for SMTP commands such as VRFY, EXPN, or RCPT TO, and analyzes Microsoft Entra ID (SigninLogs) for authentication failures specifically associated with error code 50034 (user not found). Both behaviors are indicative of an adversary attempting to validate user identities within an environment, often as a precursor to targeted phishing or brute-force attacks.
Microsoft Sentinel (KQL)
