Detect Microsoft 365 Password Spray Attack Detection in CrowdStrike LogScale
Password spraying against Microsoft 365 / Entra ID remains one of the most effective initial access techniques against SMBs. Attackers use lists of valid corporate usernames (harvested from LinkedIn, HaveIBeenPwned, or prior breaches) and try a small number of common passwords (season+year, company name variations, Welcome1!) across all accounts — staying below per-account lockout thresholds. Microsoft documented Midnight Blizzard (Cozy Bear) using this to gain initial access to Microsoft corporate accounts in 2024. Storm-1152 (bulk account creation / credential fraud group) services this on behalf of other threat actors. NCSC UK has repeatedly warned about Iranian and Russian threat actors using password spraying against UK SMBs in critical sectors. The attack targets legacy authentication protocols (IMAP, SMTP, MAPI) and BasicAuth endpoints that bypass MFA — even if the organisation has MFA deployed for interactive sign-ins.
MITRE ATT&CK
- Tactic
- Credential Access
LogScale Detection Query
#repo=azure_ad_audit event_type="Sign-in activity" result_type IN (50126, 50053, 50055, 50056, 50064)
| groupBy([ip_address, bin(time, 30m)])
| stats count() AS FailureCount, dc(user_principal_name) AS UniqueUsers
| where FailureCount >= 20 AND UniqueUsers >= 10
| sort(FailureCount, order=desc)CrowdStrike LogScale CQL detecting M365 password spray via Azure AD audit log aggregation.
Data Sources
Required Tables
False Positives & Tuning
- NAT environments
- Bulk password rotations
Other platforms for THREAT-M365-PasswordSpray
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1M365 Password Spray via AADInternals (Low-Slow)
Expected signal: Azure AD Sign-in logs record authentication failures (error code 50126) for each user/password combination tested. Multiple users from single IP within short window.
References (5)
- https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
- https://www.ncsc.gov.uk/guidance/spray-attacks
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
- https://attack.mitre.org/techniques/T1110/003/
- https://github.com/dafthack/MSOLSpray
Unlock Pro Content
Get the full detection package for THREAT-M365-PasswordSpray including response playbook, investigation guide, and atomic red team tests.