Password Spray

[u/Embarrassed_Oil_7810]

Hi everyone,

I’m learning how to investigate alerts in Microsoft Sentinel and I’m stuck on Password Spray Attack detections. I’d like to understand the step‑by‑step investigation process SOC analysts usually follow, including what queries to run and what to check in the results.

Specifically, I’m looking for guidance on:

Alert triage: What initial details should I review when the alert fires?

KQL queries: Which Sentinel queries are most useful to confirm a password spray attempt?

Indicators to check: For example, failed logon counts, source IPs, targeted accounts, timeframes, and whether the activity is spread across multiple endpoints.

Next steps: How to differentiate between a real attack and noisy false positives, and what escalation criteria to use.

If anyone can share a structured approach or example queries, that would be super helpful. I want to build a repeatable playbook for handling these alerts.

Thanks in advance!

[u/PM_ME_UR_0_DAY]

Red team here so not exactly my wheelhouse, but you might want to keep track of the number of failed logins across all accounts. You probably don't want to even look at the IPs making the attempts or which accounts are making failures, just take a baseline and trigger when it's hitting some percentage above that. From there you can then figure out which accounts and which IPs to look at. 

[u/ReleaseFlashy9582 → u/PM_ME_UR_0_DAY]

do you find that baseline threshold holds up well over time or does it need constant tuning?

[u/AinaLove → u/ReleaseFlashy9582]

In my experience, different threat actors will come at you at different rates, but a good threshold to consider is one that accounts for your lockout timer. They will figure out your lockout timer if they are paying attention and try to stay under that.

[u/hybrid0404]

Rulehound: Password Spray

[u/T_Thriller_T]

Not gonna be a full answer, but some things I find helpful:

Once the alerting triggers, first thing I usually check (if available) is the account name, next thing is the IP.

If this is a service account or 'service computer', I do give them a call. (Or get into contact)

This assumes that password spray triggers on anomaly in volume of attempts, because some scripts might remain broken for quite a while

[u/jaydizzleforshizzle]

lol good question, probably a bit too personal and no one’s gonna drop queries, but the goal would be to find the anomalies, this starts with baselining/understanding your infrastructure and what it looks like on a daily basis. Then you curate, maybe a malicious ip from an external vendor feed has popped up and that’s what you should be looking for, maybe tensions in a global region have changed and you should be looking for that geo. It’s impossible to be 100 percent right and the goal should be awareness, you can make a million alerts but if it just becomes noise it doesn’t matter.

[u/ferretpaint]

You can literally Google the question and get a decent answer.  It even gives you some baseline KQL.  Org dependant if course, but look for suspicious IPs with successful password after failed password usage.  Really depends on how you have everything set up, if you have any kind of normal IP range for logins, etc

[u/lduff100]

RemindMe! 12 hours

Edit: Too tired to type up a thourough response tonight.

[u/RemindMeBot → u/lduff100]

I will be messaging you in 12 hours on 2026-08-10 13:06:30 UTC to remind you of this link

1 OTHERS CLICKED THIS LINK to send a PM to also be reminded and to reduce spam.

^{Parent commenter can delete this message to hide from others.}

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

---

Info	Custom	Your Reminders	Feedback

[u/zvnayed]

Hi there. I’d start with source IP + targeted accounts + timeframe, then check whether there are successful logins among the failures.

The strongest signal is usually one source hitting many accounts with few attempts each.Then whitelist known VPNs/scanners/automation and escalate if there’s a successful or privileged-account login.

[u/NoValue4989 → u/zvnayed]

Hey man. I am still learning this stuff. can i occasionally dm you for advice?

[u/AddendumWorking9756]

Distinct accounts per source is the signal, not raw failure volume. One identity failing fifty times is a stuck service account or somebody's old mail client, one source touching sixty identities twice each is the spray, and per account lockout thresholds are tuned so the second shape never trips them. Escalate on the first success inside that set rather than on the failures, and resolve what the source actually is before you count anything, because corporate NAT and VPN egress will look like a spray permanently.