Password spray from one source IP followed by successful sign-in to a sprayed ac
Detects potential password spraying activity against Entra ID (Azure AD) where multiple distinct user accounts fail authentication from a single IP address, followed by at least one successful login from the same IP targeting an account involved in the failed attempts.
Splunk (SPL)
