Entra password spray
A single source IP producing many "invalid username or password" (error 50126) Entra ID sign-in failures within an hour — the low-and-slow pattern of…
What it detects
A single source IP producing many "invalid username or password" (error 50126) Entra ID sign-in failures within an hour — the low-and-slow pattern of password spraying across many accounts, which per-user brute-force thresholds miss.
MITRE ATT&CK mapping
- T1110.003Brute Force: Password Spraying· Credential Access
False positives and triage
A shared egress IP (VPN / NAT / mail gateway) can aggregate unrelated failures. Confirm the failures span many distinct users from the one IP before escalating.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/cloud/entra_password_spray.yaml, licensed under the Apache License 2.0.
id: cloud.identity.entra_password_spray
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [application]
mitre_techniques: [T1110.003]
description: |
A single source IP producing many "invalid username or password" (error 50126)
Entra ID sign-in failures within an hour — the low-and-slow pattern of password
spraying across many accounts, which per-user brute-force thresholds miss.
match:
event_category: authentication
event_outcome: failure
provider: AzureAD
native_event_id: "50126"
threshold:
count: 10
window_seconds: 3600
group_by: [source_ip]
correlation_keys: [source_ip]
false_positive_guidance: |
A shared egress IP (VPN / NAT / mail gateway) can aggregate unrelated failures.
Confirm the failures span many distinct users from the one IP before escalating.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.