Forum Discussion
Understanding alert Password Spray in MCAS with details
Hello, we are facing alert in our MCAS "Risky sign-in: password spray". There is one activity associated with that after clicking on this alert:
Description: Failed log on (Failure message: Strong authentication is required.)
Type: (in app): Login:login
User: (our user)
IP address: some remote IP
I have readed about this here: https://techcommunity.microsoft.com/t5/azure-active-directory-identity/advancing-password-spray-attack-detection/ba-p/1276936
But my question is what it means in details?
- Our user from activity performed spray attack?
- IP address from activity alert performed spray attack?
- Our user was hitted by spray attack came from IP address from activity alert?
Basically looking for way of investigation this.
2 Replies
Hello Rberlinski ,
If you are looking for a guide on how to investigate MCAS alerts and especially the "Multiple failed logins" type of alert this might be helpful:
https://docs.microsoft.com/en-us/cloud-app-security/investigate-anomaly-alerts#credential-access-alerts
It provides: "general and practical information on each alert, to help with your investigation and remediation tasks"
- Thanks but this is far away what I expected. After short call with MS "password spray" alert more or less means that user used password which is flagged as common during this attack based on MS experience. My case is still open, I will let you know when grab some additional details.
