RedVDS - High-Volume Password Spray (T1110.003)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•4

Identifies high-volume password spray attacks against Microsoft 365 originating from RedVDS infrastructure by counting unique targeted accounts from a single IP. The rule specifically looks for invalid credential errors (50126, 50053) and triggers if more than 50 unique failed accounts are observed from a single IP address within a 15-minute window.