Detect Microsoft 365 Password Spray Attack Detection in Elastic Security
Password spraying against Microsoft 365 / Entra ID remains one of the most effective initial access techniques against SMBs. Attackers use lists of valid corporate usernames (harvested from LinkedIn, HaveIBeenPwned, or prior breaches) and try a small number of common passwords (season+year, company name variations, Welcome1!) across all accounts — staying below per-account lockout thresholds. Microsoft documented Midnight Blizzard (Cozy Bear) using this to gain initial access to Microsoft corporate accounts in 2024. Storm-1152 (bulk account creation / credential fraud group) services this on behalf of other threat actors. NCSC UK has repeatedly warned about Iranian and Russian threat actors using password spraying against UK SMBs in critical sectors. The attack targets legacy authentication protocols (IMAP, SMTP, MAPI) and BasicAuth endpoints that bypass MFA — even if the organisation has MFA deployed for interactive sign-ins.
MITRE ATT&CK
- Tactic
- Credential Access
Elastic Detection Query
sequence by source.ip with maxspan=30m
[authentication where event.dataset == "azure.signinlogs" and
event.outcome == "failure" and
azure.signinlogs.properties.status.error_code in (50126, 50053, 50055)] with runs=20EQL detection for password spray: 20 or more authentication failures from the same source IP within 30 minutes — the basic spray threshold.
Data Sources
Required Tables
False Positives & Tuning
- NAT environments
- Misconfigured apps
Other platforms for THREAT-M365-PasswordSpray
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1M365 Password Spray via AADInternals (Low-Slow)
Expected signal: Azure AD Sign-in logs record authentication failures (error code 50126) for each user/password combination tested. Multiple users from single IP within short window.
References (5)
- https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
- https://www.ncsc.gov.uk/guidance/spray-attacks
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
- https://attack.mitre.org/techniques/T1110/003/
- https://github.com/dafthack/MSOLSpray
Unlock Pro Content
Get the full detection package for THREAT-M365-PasswordSpray including response playbook, investigation guide, and atomic red team tests.