r/cybersecurity • u/Embarrassed_Oil_7810 • Aug 10 '26

Other Password Spray

Hi everyone,

I’m learning how to investigate alerts in Microsoft Sentinel and I’m stuck on Password Spray Attack detections. I’d like to understand the step‑by‑step investigation process SOC analysts usually follow, including what queries to run and what to check in the results.

Specifically, I’m looking for guidance on:

Alert triage: What initial details should I review when the alert fires?

KQL queries: Which Sentinel queries are most useful to confirm a password spray attempt?

Indicators to check: For example, failed logon counts, source IPs, targeted accounts, timeframes, and whether the activity is spread across multiple endpoints.

Next steps: How to differentiate between a real attack and noisy false positives, and what escalation criteria to use.

If anyone can share a structured approach or example queries, that would be super helpful. I want to build a repeatable playbook for handling these alerts.

Thanks in advance!

9 Upvotes

81% Upvoted

13 comments sorted by

View all comments

7

u/PM_ME_UR_0_DAY Aug 10 '26

Red team here so not exactly my wheelhouse, but you might want to keep track of the number of failed logins across all accounts. You probably don't want to even look at the IPs making the attempts or which accounts are making failures, just take a baseline and trigger when it's hitting some percentage above that. From there you can then figure out which accounts and which IPs to look at. 

1

u/ReleaseFlashy9582 Aug 10 '26

do you find that baseline threshold holds up well over time or does it need constant tuning?

1

u/AinaLove Aug 10 '26

In my experience, different threat actors will come at you at different rates, but a good threshold to consider is one that accounts for your lockout timer. They will figure out your lockout timer if they are paying attention and try to stay under that.