Password spray attack against Microsoft Entra ID Seamless SSO

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


This query detects when there is a spike in Microsoft Entra ID Seamless SSO errors. They may not be caused by a Password Spray attack, but the cause of the errors might need to be investigated. Microsoft Entra ID only logs the requests that matched existing accounts, thus there might have been unlogged requests for non-existing accounts.

Attribute Value
Type Analytic Rule
Solution Microsoft Entra ID
ID fb7ca1c9-e14c-40a3-856e-28f3c14ea1ba
Severity Medium
Status Available
Kind Scheduled
Tactics CredentialAccess
Techniques T1110
Required Connectors AzureActiveDirectory
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
AADNonInteractiveUserSignInLogs ?
SigninLogs ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to Microsoft Entra ID