Azure Entra ID Risk Detection: Successful Password Spray Activity

title: "Azure Entra ID Risk Detection: Successful Password Spray Activity"
id: 4255005d-4ae4-434b-9a89-75deb87499c1
status: test
description: This rule flags risk events where the riskEventType indicates a password spray operation has been successfully performed. Password spraying is a common credential-access technique that attempts authentication across multiple accounts with the same password to evade lockouts. The detection relies on Azure Entra ID risk detection telemetry from the riskdetection service, specifically the riskEventType field.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_password_spray.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.t1110
  - attack.credential-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: passwordSpray
  condition: selection
falsepositives:
  - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
  - id: 28ecba0a-c743-4690-ad29-9a8f6f25a6f9
    type: derived