// Microsoft Sentinel / Log Analytics. Read-only; not live-tested.
// Successful logins from sources that also failed against many accounts.
let Lookback = 24h;
let Logins = REPLACE_WITH_CUSTOMER_LOGIN_TABLE
    | where TimeGenerated between (ago(Lookback) .. now());
let StuffingSources = Logins
    | summarize Accounts = dcount(AccountId), Failures = countif(Outcome == "failure") by SrcIp
    | where Accounts >= 20 and Failures >= 50
    | project SrcIp;
Logins
| where Outcome == "success"
| where SrcIp in (StuffingSources)
| project TimeGenerated, AccountId, SrcIp, UserAgent
| order by TimeGenerated asc
| take 500