Microsoft 365 Password Spray Attack Detection

// THREAT: Microsoft 365 Password Spray Detection
// Detects systematic password spraying against M365 / Entra ID
// using sign-in failure patterns across multiple users from shared infrastructure

// Alert 1: Single IP targeting many accounts (spray pattern)
let SprayThreshold_UserCount = 10;
let SprayThreshold_FailureCount = 20;
let SprayWindow = 30min;
AADSignInLogs
| where TimeGenerated > ago(24h)
| where Status.errorCode in (50126, 50053, 50055, 50056, 50064, 50074, 50076, 50079)
    // 50126=invalid credentials, 50053=locked, 50055=expired password, 50056=no password
    // 50064=credential validation failure, 50074=strong auth required
| summarize
    FailureCount=count(),
    UniqueUsers=dcount(UserPrincipalName),
    TargetUsers=make_set(UserPrincipalName),
    ErrorCodes=make_set(Status.errorCode),
    Apps=make_set(AppDisplayName)
  by IPAddress, bin(TimeGenerated, SprayWindow)
| where UniqueUsers >= SprayThreshold_UserCount and FailureCount >= SprayThreshold_FailureCount
| extend ThreatType = "PasswordSpray_MultipleUsers_SingleIP"
| extend Severity = "High";
// Alert 2: Successful sign-in following spray activity from same IP
let SprayIPs = AADSignInLogs
| where TimeGenerated > ago(24h)
| where Status.errorCode in (50126, 50053, 50055)
| summarize Failures=count(), Users=dcount(UserPrincipalName)
  by IPAddress, bin(TimeGenerated, 30m)
| where Failures >= 20 and Users >= 10
| distinct IPAddress;
AADSignInLogs
| where TimeGenerated > ago(24h)
| where Status.errorCode == 0
| where IPAddress in (SprayIPs)
| project TimeGenerated, UserPrincipalName, IPAddress, Location,
    AppDisplayName, AuthenticationRequirement, Status
| extend ThreatType = "PasswordSpray_SuccessfulBreachAfterSpray"
| extend Severity = "Critical"

index=azure sourcetype="azure:aad:signin"
properties.status.error_code IN (50126, 50053, 50055, 50056, 50064)
| eval src_ip=properties.ip_address
| eval user=properties.user_principal_name
| bin _time span=30m
| stats
    count AS FailureCount,
    dc(user) AS UniqueUsers,
    values(user) AS TargetedUsers,
    values(properties.status.error_code) AS ErrorCodes,
    values(properties.app_display_name) AS Applications
  BY src_ip, _time
| where UniqueUsers >= 10 AND FailureCount >= 20
| appendpipe
    [| search FailureCount >= 50
     | eval Severity="CRITICAL" | eval SprayType="HighVolume"]
| eval Severity=if(isnull(Severity),
    if(UniqueUsers >= 20, "HIGH", "MEDIUM"), Severity)
| eval SprayType=if(isnull(SprayType), "LowSlow", SprayType)
| eval ThreatActors="Midnight Blizzard, Storm-1152, Iranian APT"
| eval CVERef="T1110.003"
| table _time, src_ip, UniqueUsers, FailureCount, TargetedUsers,
    ErrorCodes, Applications, Severity, SprayType
| sort - FailureCount

sequence by source.ip with maxspan=30m
  [authentication where event.dataset == "azure.signinlogs" and
   event.outcome == "failure" and
   azure.signinlogs.properties.status.error_code in (50126, 50053, 50055)] with runs=20

SELECT
  sourceip,
  COUNT(*) AS FailureCount,
  COUNT(DISTINCT username) AS UniqueUsers,
  MIN(DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss')) AS FirstAttempt,
  MAX(DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss')) AS LastAttempt
FROM events
WHERE
  LOGSOURCETYPEID = 397
  AND starttime > NOW() - 86400000
  AND eventid IN (50126, 50053, 50055, 50056, 50064)
GROUP BY sourceip, TRUNC(starttime, 1800000)
HAVING UniqueUsers >= 10 AND FailureCount >= 20
ORDER BY FailureCount DESC

_sourceCategory="azure/aad/signin"
| json "properties.status.errorCode" AS error_code
| json "properties.ipAddress" AS src_ip
| json "properties.userPrincipalName" AS user
| where error_code in ("50126", "50053", "50055", "50056", "50064")
| bin _time span=30m
| stats
    count AS FailureCount,
    dcount(user) AS UniqueUsers,
    values(user) AS TargetedUsers
  by src_ip, _time
| where UniqueUsers >= 10 AND FailureCount >= 20
| sort by FailureCount desc

rule m365_password_spray_t1110_003 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects M365/Entra ID password spray: 20+ auth failures targeting 10+ unique accounts from the same source IP within 30 minutes"
    mitre_attack_technique = "T1110.003"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "USER_LOGIN"
    $e.security_result.action = "FAIL"
    $e.metadata.product_name = "Azure AD"
    $e.principal.ip = $src_ip
    $e.target.user.email_addresses[0] = $user

  match:
    $src_ip over 30m

  condition:
    #e >= 20 and #user >= 10
}

#repo=azure_ad_audit event_type="Sign-in activity" result_type IN (50126, 50053, 50055, 50056, 50064)
| groupBy([ip_address, bin(time, 30m)])
| stats count() AS FailureCount, dc(user_principal_name) AS UniqueUsers
| where FailureCount >= 20 AND UniqueUsers >= 10
| sort(FailureCount, order=desc)