How to Detect Password Spray Attacks Against Active Directory

// Sentinel KQL: Detect password spray via unique failed account count per source IP
// Focus: many DIFFERENT accounts failing from one IP (spray signature)
// vs. many failures against ONE account (brute force signature)
SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID == 4625  // Failed logon
// Filter to relevant logon types (network and interactive):
| where LogonType in (3, 10)  // 3 = network, 10 = remote interactive (RDP)
// Filter to password-wrong failures (not unknown user):
| where SubStatus == "0xC000006A"  // Wrong password for valid user
   or SubStatus == "0xC0000064"    // Non-existent username (include to catch user enum)
| summarize
    FailedAccounts = dcount(TargetUserName),
    AccountList = make_set(TargetUserName, 30),
    TotalFailures = count()
    by IpAddress, bin(TimeGenerated, 30m)
// Spray threshold: 20+ unique accounts failed from one IP in 30 minutes:
| where FailedAccounts >= 20
| where TotalFailures < FailedAccounts * 3  // Spray: few retries per account
| project TimeGenerated, IpAddress, FailedAccounts, TotalFailures,
    AccountList
| order by FailedAccounts desc

On-premises spray from distributed IPs (botnet spray):

// Slower distributed spray: fewer accounts per IP, but same accounts hit from many IPs
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4625
| where SubStatus == "0xC000006A"  // Wrong password
// Count: how many different source IPs tried each account
| summarize
    SourceIPs = dcount(IpAddress),
    IPList = make_set(IpAddress, 20),
    FailureCount = count()
    by TargetUserName, bin(TimeGenerated, 1h)
// Alert: same account tested from many different IPs
| where SourceIPs >= 5 and FailureCount >= 5
// This catches spray-from-botnet where each node sprays a small subnet
| order by SourceIPs desc

On-premises AD: enable verbose failed logon detail:

GPO: Computer Configuration > Windows Settings > Security Settings >
Advanced Audit Policy Configuration > Logon/Logoff >
"Audit Logon": Failure = Enabled
"Audit Account Logon": Failure = Enabled (on DCs, captures NTLM/Kerberos failures)

Event 4625 on member servers = NTLM attempt
Event 4771 on DCs = Kerberos pre-auth failure (separate spray detection needed)

// Sentinel: Entra ID sign-in log spray detection
SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType != "0"  // Failed sign-ins
// Focus on password-wrong failures (not locked out, not MFA fail):
| where ResultDescription !has "locked" and ResultDescription !has "MFA"
| summarize
    FailedUsers = dcount(UserPrincipalName),
    UserList = make_set(UserPrincipalName, 30),
    TotalAttempts = count()
    by IPAddress, bin(TimeGenerated, 30m)
| where FailedUsers >= 15  // 15+ unique users failed from one IP = spray
| project TimeGenerated, IPAddress, FailedUsers, TotalAttempts, UserList

Entra ID Identity Protection built-in spray detection:

Microsoft Entra ID Identity Protection (P2) includes a Password Spray risk detection that fires automatically when its machine learning model detects spray patterns.

Entra admin center > Protection > Identity Protection > Risk Detections
Detection type: "Password spray" (risk level: High)

To alert on it in Sentinel:
AADRiskyUsers
| where RiskEventTypes has "passwordSpray"
| project UserPrincipalName, RiskLevel, RiskState, RiskLastUpdatedDateTime

Or via the unified sign-in risk:
SigninLogs
| where RiskEventTypes_s has "passwordSpray"
| summarize count() by UserPrincipalName, IPAddress

Detect spray followed by successful logon (compromise confirmation):

// Alert: user who appears in failed spray list then successfully authenticates
let SprayIPs = SigninLogs
| where TimeGenerated > ago(2h)
| where ResultType != "0"
| summarize FailedUsers = dcount(UserPrincipalName) by IPAddress
| where FailedUsers >= 15
| project IPAddress;

SigninLogs
| where TimeGenerated > ago(2h)
| where ResultType == "0"  // Successful
| where IPAddress in (SprayIPs)
// Successful logon from an IP that was spraying = spray succeeded:
| project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName

Entra ID Smart Lockout (already on by default: verify settings):

Entra admin center > Protection > Authentication methods > Password protection

Lockout threshold: 10 (default): lower to 5 for sensitive tenants
Lockout duration (seconds): 60 (default): increase to 300 for higher friction

Smart Lockout tracks per-credential-hash, not per-IP:
- Legitimate users from multiple locations do NOT get locked out by attacker spray
- Attacker IPs DO get blocked after threshold even if rotating users

Entra ID Password Protection (blocks common passwords):

Entra admin center > Protection > Authentication methods > Password protection

Enforce custom banned passwords: Enabled
Add company-specific terms:
- [CompanyName], [CompanyAcronym]
- Common seasons: Spring, Summer, Fall, Winter
- Common years: 2023, 2024, 2025

This blocks the most common spray targets:
- CompanyName2024!
- Summer2024@
- Password123! (Microsoft global banned list already catches this)

For on-premises AD:
Deploy Microsoft Entra Password Protection for Windows Server AD
(Agent on DCs enforces the same banned password list for on-prem accounts)

Conditional Access: block spray from known bad countries:

Conditional Access > Named Locations > Countries location
Exclude countries where your org has no users

Policy: Block sign-in from outside approved countries
Target: All users
Conditions: Locations = exclude approved countries
Grant: Block access

This eliminates overseas spray infrastructure as an attack vector

Enable MFA for all accounts (eliminates spray as a standalone attack):

Conditional Access > New Policy
Users: All users
Cloud apps: All cloud apps
Grant: Require multi-factor authentication

With MFA enforced, a successful spray attack (correct password found) still
requires defeating MFA before the account is compromised: spray becomes
only the first step of a longer attack chain