How to Hunt Microsoft 365 Password-Spraying Attacks and Strengthen Defenses
Summary
Huntress explains how to hunt for Microsoft 365 password spraying, including jitter and cloud IP rotation, and recommends password protection, blocking legacy authentication, and phishing-resistant MFA.
Key points
- Password spraying spreads attempts across accounts, so alerts focused on repeated failures for one user may miss it; defenders should understand normal sign-in patterns.
- TREVORspray can randomize login delays, while CredMaster can schedule attempts during working hours to evade time- and off-hours-based detections.
- CredMaster and git-rotate use AWS or GitHub Actions infrastructure to rotate IP addresses; Huntress advises investigating cloud-service sign-ins rather than dismissing them as trusted.
- Huntress describes hunting for unusual sign-ins across ASNs, operating systems, browsers, and geographic locations, grouped by user and session.
- In Huntress examples, further review of anomalous sign-ins led analysts to confirm credential theft and notify affected customers.
- Recommended protections include preventing weak or previously compromised passwords, blocking legacy authentication where possible, and using the strongest feasible MFA methods; the article cautions that MFA alone is not enough.
Article Details
- Defense Focus
- Detecting and preventing password-spraying attacks against Microsoft 365 identities, including attempts that evade simple failed-login and single-IP detections.
- Detection Methods
- Establish normal authentication patterns for each organization and investigate deviations rather than relying on failed-login counts alone.
- Hunt for authentication anomalies grouped by username and session ID, including multiple ASNs, operating systems, browsers, or geographic locations.
- Correlate sign-in IPs with published AWS and GitHub IP ranges; investigate matches rather than dismissing them as trusted cloud-service traffic.
- Review successful authentication events in context, including VPN use and unusual or programmatic user agents, and compare them with the user's normal activity.
- Account for randomized delays and jitter, working-hours scheduling, and IP rotation when designing detections.
- Data Sources
- Microsoft 365 authentication and sign-in events
- Username and session ID
- Source IP address and ASN
- Operating system and browser
- User agent
- Geographic location
- Published AWS and GitHub IP ranges
- Rule Types
- ES|QL query
- Platforms
- Microsoft 365
- Microsoft Entra
- Huntress platform
- Defensive Actions
- Enable Microsoft Entra password protection to block known-weak or previously compromised passwords.
- Educate users to choose unique, strong passwords for Microsoft 365 and Entra accounts.
- Block legacy authentication protocols in the tenant where possible.
- Use the strongest feasible phishing-resistant multi-factor authentication methods; do not rely on MFA alone.
- Investigate anomalous successful sign-ins and notify affected customers when compromise is confirmed.
MITRE ATT&CK
People
Threat Actors
Vendors
Amazon Web ServicesFor example, tools such as CredMaster use AWS to rotate IP addresses:GitHubSimilarly, newer tools like git-rotate use GitHub actions to mimic this dynamic:HuntressThe Huntress platform protects M365 identities at scale, looking for aspects such as session hijacking, credential theft, as well as general business email compromise tactics, techniques, and procedures. As part of thisMicrosoftHomeBlogPassword Spraying Attacks in Microsoft 365: Detection, Tools & Defense
Products
Microsoft 365 Apps for EnterpriseHomeBlogPassword Spraying Attacks in Microsoft 365: Detection, Tools & DefenseMicrosoft EntraConsider the implementation of Microsoft Entra password protection which prevents users from setting known-weak or previously compromised passwords. Licensing and cost constraints may prevent you from implementing these
Tools
aws-ip-lookupHowever, if we use a tool like aws-ip-lookup to take a closer look at the IPs generating the M365 events, we can see that these logins originate from the AWS API Gateway service:CredMasterhelp documentation for the TREVORspray tool, with delay and jitter options highlighted.Other tools like CredMaster take this dynamic a step further and introduce modules that specifically spray accounts during workinggit-rotatetactics now involve the use of cloud services: Modern password spraying tools like CredMaster and git-rotate use cloud infrastructure to rotate IP addresses, making traditional detection methods ineffective.TREVORsprayTools such as TREVORspray have built-in jitter and delay capabilities to avoid temporal-based detections as well as any lockout policies: