A regional manufacturer woke up to a Monday where Entra ID Smart Lockout looked healthy, the SIEM showed no brute-force spikes, and three service accounts with legacy SMTP auth had already handed an operator a foothold. The attacker had tried one common password against roughly 400 usernames over six hours, rotating residential proxies every few attempts. Per-account failure counts stayed under the lockout threshold. Per-IP counters never climbed because each source appeared once or twice. By the time ransomware staging traffic matched patterns discussed in recent ISC Stormcast coverage and broader reporting on rising ransomware activity, the spray phase had been over for days.
That failure mode is common. Password spray is engineered to sit under the controls most identity platforms ship by default. Teams that treat Smart Lockout, fail2ban-style IP bans, or a single “too many failed logons” rule as spray coverage leave a quiet gap attackers still abuse before destructive cloud activity, similar in spirit to the Azure tenant compromises that make headlines when an initial auth foothold turns into wider damage.
What spray looks like when thresholds stay green
Credential stuffing replays known username and password pairs from breaches. Password spray uses a small password set against a large directory of valid or guessed usernames. The operational signature is breadth over depth: many identities, few secrets, long windows, and source diversity.
In practice you see combinations like these:
- One or two passwords (SeasonYear!, Company123, Welcome1) attempted against dozens to thousands of accounts inside a 24-hour window
- Source IPs that rotate through cloud VPN, bulletproof hosting, or consumer broadband, so no single address trips volume rules
- Protocols that bypass modern interactive controls: basic auth to Exchange Online, IMAP, POP, legacy VPN, RDP gateways, RDWeb, or older RADIUS integrations
- Success rates low enough that risk engines trained on stuffing volume score the traffic as noise
The Times Car breach scale and marketplace sales of identity documents remind defenders that username lists are cheap. Attackers rarely need to invent targets; they spray known email formats against your tenant after a public leak elsewhere in the supply chain.
Why default lockout and identity alerts miss it
Smart Lockout and similar features protect individual accounts from rapid guessing. Spray authors choose attempt rates that stay under those ceilings on purpose. A rule that fires after ten failures from one IP against one user will sleep through one failure per user from a hundred IPs.
Cloud risk detections help when sensitivity is tuned and the right signals are licensed, yet many tenants leave password-spray related detections at default or medium and suppress noisy auth failures from partner networks. The myth holds because the dashboard shows “identity protection enabled.” Reality is that spray detection is a correlation problem across users, passwords or hash-equivalent failure patterns, protocols, and time, not a single counter on one principal.
Build detections that follow the password, not the IP
Start from identity telemetry you already collect: Entra ID sign-in logs, AD Domain Controller security events (4625 with status and substatus), VPN concentrator auth, and mail protocol logs. The useful unit of work is a sliding window that answers one question: how many distinct users failed authentication with the same candidate secret behavior in N minutes?
Directory-wide failure fan-out
For Entra ID, group failed interactive and non-interactive sign-ins by approximate time bucket (15–60 minutes), application or client app ID, and optionally by failure reason codes such as invalid credentials. Count distinct userPrincipalName values. Alert when that count crosses a threshold calibrated to your directory size. A tenant with 2,000 users might alert at 25 distinct failures with the same password-like pattern in 30 minutes; a 50,000-user tenant needs a higher bar and peer baselining by department or sync source.
On-premises, correlate 4625 events where the failure substatus indicates bad password (often 0xC000006A) and ignore lockout and expired-password noise. Bucket by workstation name or source network when present, but keep the primary key as distinct Account Name values sharing the same time window and Logon Type.
Username continuity across rotating exits
Spray operators reuse username lists. When per-host counters stay quiet, follow usernames that fail from many sources in sequence. A single mailbox that fails from fifteen ASNs in two hours with no success, followed by neighboring mailboxes showing the same cadence, is spray even when each IP looks innocent. Pair that hunt with geo and ASN context only as secondary features; first-time cloud exits used in extortion staging often have clean reputation, which matches how modern crews prefer fresh addresses over repeat offenders.
Protocol and client app carve-outs
Weight non-interactive and legacy clients higher. A burst of IMAP or authenticated SMTP failures against many users deserves a lower threshold than interactive browser failures that Conditional Access already frustrates. If you still allow basic auth anywhere, treat that path as a dedicated spray sensor with stricter fan-out rules.
Remediation that survives production tradeoffs
Detection alone leaves live sessions intact. Recent identity intrusion reporting, including cases where password resets cleared the form while sessions remained valid, shows why spray response must cover tokens and protocol access, not only the password.
- Contain the auth surface first. Disable basic auth where business allows. Enforce phishing-resistant MFA on admin and remote access. Block legacy mail protocols for users who do not need them. Tradeoff: some scanners and line-of-business apps break until you issue app passwords or modern auth clients. Stage by group and keep a break-glass path with logging.
- Tune Smart Lockout and on-prem lockout together. Lowering thresholds without spray fan-out detection creates help-desk outages during password-change campaigns. Raise the value of directory-wide correlation first, then tighten per-account settings for privileged tiers.
- Automate response on spray score, not on single failures. When fan-out fires, temporarily require MFA challenges, step-up Conditional Access, or block legacy protocols for the affected cohort. Revoke refresh tokens for any account that succeeded during the window. Caveat: broad token revocation during a false positive can interrupt executives mid-travel; scope to users in the spray set and to protocols that participated.
- Seed canary accounts. Place a handful of realistic but unused mailboxes in the directory with alerting on any auth attempt. Spray will often touch them. Keep canaries out of distribution lists and documentation so admins do not authenticate to them by habit.
- Feed confirmed spray sources into perimeter hunts carefully. Blocking the IPs you saw is useful for the current wave and weak against the next residential pool. Prefer temporary deny lists with short TTL plus identity controls that remain after the IPs change.
A workable monitoring checklist
- Fan-out rule: distinct failed users per time window, split by client app and protocol
- Privileged-tier rule: any failure streak against admin, Tier-0, or service accounts with password auth enabled
- Success-after-spray rule: a successful sign-in for a user who appeared in a spray set within 72 hours
- Legacy-protocol rule: lower thresholds for IMAP, POP, SMTP AUTH, and older VPN
- Canary rule: any authentication event on honeypot identities
- Session hygiene: token revocation and Conditional Access review when spray coincides with unusual cloud admin actions
Calibrating without drowning the SOC
False positives cluster around mass password resets, HR onboarding sync errors, and misconfigured service principals. Exclude known sync identities and change-window tickets from spray fan-out, or raise thresholds during announced resets. Keep a weekly review of suppressed spray candidates; attackers schedule around your change calendar.
Measure detection quality by time from first sprayed failure to first analyst-visible alert, and by whether any successful auth in that cohort was caught before lateral movement. Volume of blocked IPs is a poor KPI for spray.
Takeaways for this week
Assume Smart Lockout and per-IP brute-force rules leave spray invisible until a password hits. Detect by counting distinct users sharing failure behavior inside a short window, weight legacy protocols, and respond with protocol lockdown plus token revocation. Tie spray findings to ransomware and destructive cloud playbooks early; the auth phase is where you still have cheap options. Use current threat reporting on Azure tenant compromise and ransomware growth as pressure to test these detections against your own sign-in history, not as abstract awareness content.
