Password Spray With Anomalously High Success Rate (Possible OSINT-Tailored Guess
Detects anomalous sign-in patterns from a single IP address that target multiple accounts with a high success rate within a short timeframe. This behavior is indicative of targeted credential guessing or password spraying informed by reconnaissance, as it deviates from the typical low-success-rate patterns of broad brute-force attacks.
Microsoft Sentinel (KQL)
