Password Spray Response: Detection Signals + Automation Steps
Password spray attacks are designed to evade detection. They move slowly, spread across many accounts, and often fly under traditional alert thresholds. This guide covers the detection signals that matter, the response workflow that stops spray attacks before credential compromise, and how to automate containment without locking out legitimate users.
What Makes Password Spray Different
Unlike brute-force attacks that hammer a single account with thousands of password attempts, password spray attacks take a different approach: they try a small number of common passwords against many accounts simultaneously.
| Characteristic | Brute Force | Password Spray |
|---|---|---|
| Target | Single account | Many accounts |
| Password attempts | Thousands per account | 1-3 per account |
| Speed | Fast, aggressive | Slow, distributed |
| Lockout trigger | Almost always | Rarely (stays under threshold) |
| Detection difficulty | Easy | Hard without correlation |
Why This Matters
Password spray attacks are specifically designed to stay under lockout thresholds. If your detection relies on "5 failed logins in 5 minutes," spray attacks will never trigger it. You need correlation-based detection that looks across accounts, not within them.
Detection Signals That Matter
Effective password spray detection requires correlating signals across multiple accounts and time windows. Here are the signals that reliably indicate spray activity:
High Volume of Failed Authentications from Single IP
Multiple accounts receiving failed authentication attempts from the same source IP within a short window.
Threshold: 10+ unique accounts with failed auth from same IP in 10 minutes
Identical Error Codes Across Accounts
Spray attacks often produce identical authentication error codes (like AADSTS50126 in Entra ID) across many accounts simultaneously.
Look for: AADSTS50126 (invalid password), AADSTS50053 (locked out), AADSTS50057 (disabled account)
Legacy Protocol Usage
Attackers often use legacy authentication protocols (IMAP, POP3, SMTP) that bypass MFA. Sudden spikes in legacy auth failures are a strong spray indicator.
Client apps to monitor: Exchange ActiveSync, IMAP4, POP3, SMTP AUTH, Other clients
Suspicious User Agent Strings
Spray tools often use distinctive or outdated user agent strings. Watch for unusual patterns that don't match your normal traffic.
Red flags: Python-urllib, curl, empty user agents, very old browser versions
Geographic Anomalies
Failed authentications from unusual geographies, especially combined with other signals, indicate spray activity from external threat actors.
Correlate: Source country + failed auth volume + time of day
Sudden Success After Pattern of Failures
The most critical signal: a successful authentication immediately following the spray pattern indicates a compromised account.
CRITICAL: Success from spray IP/pattern = immediate containment required
Detection Confidence Matrix
Individual signals have varying confidence levels. Combining multiple signals increases detection accuracy and reduces false positives.
| Signal Combination | Confidence | Recommended Action |
|---|---|---|
| High failed auth volume from single IP | Medium | Monitor, enrich with threat intel |
| + Legacy protocol usage | High | Block IP, alert SOC |
| + Suspicious user agent | High | Block IP, alert SOC |
| + Geographic anomaly | Very High | Block IP, force MFA on targeted accounts |
| + Successful auth in pattern | Critical | Immediate account containment |
Automated Response Workflow
Password spray response has two distinct tracks: blocking the attack source and containing any compromised accounts. Both should run in parallel.
Track 1: Block Attack Source
Extract all IPs associated with the spray pattern
Check IP reputation, ASN, known malicious indicators
Block IP at identity layer (Entra ID Named Locations)
Add to firewall/WAF blocklist if applicable
Log IPs, user agents, timing patterns for future correlation
Track 2: Contain Compromised Accounts
Only triggered if successful authentication is detected within the spray pattern.
Invalidate refresh tokens and active sessions immediately
Require password change on next sign-in
Clear existing MFA methods, force re-enrollment
May need human approval
Check for inbox rules, OAuth apps, mailbox forwarding
Delete malicious inbox rules, revoke OAuth grants
Requires investigation
Inform user of compromise and required actions
What to Automate vs. Human Review
Not every password spray response action should be fully automated. Here's guidance on where automation adds value without creating risk.
Safe to Fully Automate
- •Block source IP at identity layer
- •Revoke sessions for compromised accounts
- •Force password reset
- •Enrich IPs with threat intelligence
- •Notify user and SOC
- •Log and document IOCs
Requires Human Approval
- •Force MFA re-registration (disrupts user)
- •Disable account entirely
- •Remove OAuth app consents
- •Delete inbox rules (may be legitimate)
- •Block IP ranges (may affect legitimate users)
- •Escalate to executive accounts
Microsoft Entra ID Detection Reference
For organizations using Microsoft Entra ID (Azure AD), these are the specific log sources and detection signals to monitor.
Sign-in Logs to Monitor
- •Non-interactive sign-ins - Where most spray attempts appear
- •Service principal sign-ins - Application-based spray attempts
- •Risky sign-ins report - Built-in Identity Protection signals
Key Error Codes
| Code | Meaning | Spray Indicator |
|---|---|---|
| AADSTS50126 | Invalid username or password | Primary spray signal |
| AADSTS50053 | Account locked | Spray exceeded lockout threshold |
| AADSTS50057 | Disabled account | Spray hitting disabled accounts |
| AADSTS50034 | User doesn't exist | Spray with enumerated usernames |
| AADSTS50076 | MFA required | Password correct, MFA blocked |
Entra ID Identity Protection Risk Detections
- •Password spray - Built-in detection (medium confidence)
- •Unfamiliar sign-in properties - Anomalous login characteristics
- •Anonymous IP address - Sign-in from VPN/Tor
- •Atypical travel - Impossible travel correlation
Common Detection Mistakes
Relying only on per-account failed login thresholds
Problem: Spray attacks stay under per-account limits by design
Fix: Correlate failed logins across accounts from the same source
Ignoring non-interactive sign-in logs
Problem: Most spray attacks target non-interactive endpoints
Fix: Monitor all sign-in log types, not just interactive
Blocking entire IP ranges reactively
Problem: May block legitimate users on shared infrastructure
Fix: Block specific IPs, use Conditional Access for broader controls
Not checking for successful auth in spray pattern
Problem: Missing the actual compromise among the noise
Fix: Always check for successful auth from spray source IPs
Treating all spray detections equally
Problem: Wasting time on low-confidence detections
Fix: Use signal correlation to prioritize high-confidence detections
Automate Password Spray Response with BitLyft AIR
BitLyft AIR correlates password spray signals across your identity infrastructure and executes containment automatically—blocking attack sources and containing compromised accounts in seconds.
See Automated Spray Response in Action