Microsoft 365 Defender - password spray attacks
MD365 Password Spray Attacks
Query
CloudAppEvents
| where Timestamp > ago(1d)
| where ApplicationId == 11161
| where ActionType == "Update user."
| where isnotempty(AccountObjectId)
| where RawEventData has_all("StrongAuthenticationRequirement","[]")
| mv-expand ModifiedProperties = RawEventData.ModifiedProperties
| where ModifiedProperties.Name == "StrongAuthenticationRequirement" and ModifiedProperties.OldValue != "[]" and ModifiedProperties.NewValue == "[]"
| mv-expand ActivityObject = ActivityObjects
| where ActivityObject.Role == "Target object”
| extend TargetObjectId = tostring(ActivityObject.Id)
| project Timestamp, ReportId, AccountObjectId, ActivityObjects, TargetObjectIdAbout this query
Explanation
The query is used to gather information about password spray attacks in Microsoft 365 Defender. It includes several queries to identify password spray activity, other activities from the alerted ISP, sign-in patterns for the impacted user, MFA fatigue attacks, MFA reset activities, and new email inbox rules created by the impacted user. These queries help determine whether the activity is suspicious and gather more information related to the password spray attack alerts.
Details
Alex Verboon
Released: June 4, 2023
Tables
IdentityLogonEvents
CloudAppEvents
AADSignInEventsBeta
AlertInfo
Keywords
Microsoft 365 DefenderIdentityLogonEventsCloudAppEventsAADSignInEventsBetaAlertInfo
Operators
|>==whereago()isnotempty()summarizebydcount()>=<bin()count()!=inarg_max()pack_array()containsprojecthas_all()mv-expandextendtostring()