Azure AD Password Spray: Low-Volume Failures Across Many Accounts

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•1

Detects potential password spraying activity by identifying high-volume failed authentication attempts (ResultType 50126 or 50053) against multiple accounts from a single source IP, followed by a successful authentication from the same IP. This pattern indicates an adversary who has identified one or more valid credentials after an initial spraying campaign.