huntrule

Azure Entra ID risk event: successful password spray detection

Flags Azure Entra ID risk events indicating a successful password spray attempt.

FreeReviewedSigma · High · v5
Product
azure
Service
riskdetection
Author
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' (SigmaHQ), DRL 1.1
Published
2023-09-03
Updated
2026-07-31
AnalysisDetection
title: "Azure Entra ID risk event: successful password spray detection"
id: 4255005d-4ae4-434b-9a89-75deb87499c1
status: test
description: This rule flags Azure Entra ID Risk Detection events where the riskEventType is passwordSpray, indicating a successful password spray attempt. Attackers use password spraying to compromise accounts by trying the same password across many users while avoiding lockouts. The detection relies on risk telemetry from the Azure risk detection service indicating the specific password spray risk type.
references:
  - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray
  - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/identity_protection/azure_identity_protection_password_spray.yml
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo', Huntrule Team
date: 2023-09-03
tags:
  - attack.t1110
  - attack.credential-access
logsource:
  product: azure
  service: riskdetection
detection:
  selection:
    riskEventType: passwordSpray
  condition: selection
falsepositives:
  - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high
license: DRL-1.1
related:
  - id: 28ecba0a-c743-4690-ad29-9a8f6f25a6f9
    type: derived