Yeah agreed that there wasn’t much information there. Having investigated similar password spray attacks, I’m guessing they just looked at the entire set of fa

Yeah agreed that there wasn’t much information there. Having investigated similar password spray attacks, I’m guessing they just looked at the entire set of failed Azure CLI logins from the same ASN (AS6939). Then that activity was distinct enough from usual activity in the tenant to suspect it’s part of the same campaign (no prior logins from AS6939, little to no legitimate use of Azure CLI, or the job profile of the targeted users doesn’t align with usage of Azure CLI).