Password spray or brute force followed by successful sign-in and Azure ARM
Detects potential credential spraying or brute force activity against Microsoft Entra ID (Azure AD) followed by a successful sign-in from the same IP address, subsequently leading to Azure Resource Manager (ARM) administrative actions performed by the same identity.
Microsoft Sentinel (KQL)
