M365 Password Spray via Rotating AWS EC2 IPs (FireProx Proxy Rotation)
Detects the TeamFiltration/UNK_CondorFiltration spray signature: a large number of distinct target UserPrincipalNames within a single tenant, each receiving only a handful of sign-in attempts, spread across many distinct AWS EC2-hosted source IPs/regions within a short time window. Individual sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies, remote contractors) are not flagged on their own; the rule requires both the account-fanout and the IP-rotation dimensions to co-occur for the same tenant in the same window.
Sigma
