High-velocity password spraying against M365 / Exchange Online accounts

ills3c Intel&Coffee@Ills3C

•updated 4 days ago•8•0•15

Detects password spraying activity against Azure Active Directory / Microsoft 365 services where a single source IP attempts to authenticate against numerous distinct user accounts with low attempt counts per account and sustained over time, while excluding successful authentication IPs.