Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
Incidents and response

Alert Classification Password Spray Attack

4 September 2026Doc update+12 / −10 lines

In brief

The article now explains MFA fatigue, clarifies query descriptions and alert references, and adds a Kusto query to check whether MFA strong authentication requirements were removed from Microsoft Entra ID accounts.

What Defender admins need to know

No administrator action is required. The updated guidance can help administrators investigate suspicious MFA changes and post-compromise inbox rules.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

[!INCLUDE Microsoft Defender XDR rebranding]

Threat actors use innovative ways to compromise their target environments. One type of attack gaining traction is the password spray attack, where attackers aim to access many accounts within a network with minimal effort. Unlike traditional brute force attacks, where threat actors try many passwords on a single account, password spray attacks focus on guessing the correct password for many accounts with a limited set of commonly used passwords. This approachThe password spray technique makes the attack particularly effective against organizations with weak or easily guessable passwords, leading to severe data breaches and financial losses for organizations.

Attackers use automated tools to repeatedly attempt to gain access to a specific account or system using a list of commonly used passwords. Attackers sometimes abuse legitimate cloud services by creating many virtual machines (VMs) or containers to launch a password spray attack.

  • Multi-factor authentication (MFA)-related attacks

    • Attackers use MFA fatigue—repeated authentication prompts intended to pressure users into approving access—to bypass this security measure that organizations adopt to protect their systems. Check for multiple MFA requests raised by an impacted user account.
    • Attackers might perform MFA tampering using an impacted user account with elevated privileges by disabling MFA protection for other accounts within the tenant. Check for suspicious admin activities performed by an impacted user.

  • Internal phishing attacks

Advanced hunting is a query-based threat hunting tool that lets you inspect events in your network and locate threat indicators.

Use these queries to gather more information related to the password spray alert and determine whether the alerted sign-in activity is suspicious.

Ensure you have access to the following tables:


Use this query to identify other activities from the alerted ISP.ISP listed in the alert details.

```kusto
CloudAppEvents
| summarize count() by Application, ActionType, bin(Timestamp, 1h)

Use this query to identify sign-in patterns for the impacted user.user account identified in the alert.

IdentityLogonEvents
| where FailureCount >= 10

Use this query to identify MFA reset activities. The following query defines MFA-related reset and bypass action types, then correlates matching cloud app events with alert data to surface suspicious MFA changes.

let relevantActionTypes = pack_array("Disable Strong Authentication.","system.mfa.factor.deactivate", "user.mfa.factor.update", "user.mfa.factor.reset_all", "core.user_auth.mfa_bypass_attempted");
| where ActionType in (relevantActionTypes)
| where RawEventData contains "success"
| project Timestamp, ReportId, AccountObjectId, IPAddress, ActionType

Use the following query to check whether MFA strong authentication requirements were removed from user accounts in Microsoft Entra ID, which can indicate post-compromise MFA tampering:

CloudAppEvents
| where Timestamp > ago(1d)
| where ApplicationId == 11161
| project Timestamp, ReportId, AccountObjectId, ActivityObjects, TargetObjectId

Use this query to find suspicious inbox rules created by the impacted user account identified in the password spray alert during sessions associated with suspected compromise.flagged as suspicious in your investigation. This query helps identify post-compromise activity where attackers create inbox rules to hide or redirect email.

CloudAppEvents