ALT-2401 · Entra ID
Password spray against Entra ID tenant
142 failed sign-ins across 61 distinct accounts from 4 source IPs in a 9 minute window, followed by one success.
highInvestigatingconfidence 90% · 1970-01-01 05:54:00Z · rule DET-0087 Distributed Authentication Failure BurstLinked to INC-1042
Detection summary
142 failed sign-ins across 61 distinct accounts from 4 source IPs in a 9 minute window, followed by one success.
- Affected host
- WS-ENG-231
- Affected user
- r.wijaya
- Source IP
- 10.20.22.101
- Detection rule
- DET-0087 Distributed Authentication Failure Burst
- Log source
- Entra ID
- Assignee
- Unassigned
Recommended actions
- Force password reset for the successfully authenticated account
- Enable conditional access blocking legacy auth
- Add source IP ranges to the identity blocklist
Analyst decision
Triage checklist
- 1. Confirm the detection logic matched genuine activity.
- 2. Check user and asset context for expected behaviour.
- 3. Pivot on host, user, IP and hash in the Log Explorer.
- 4. Enrich IOCs with threat intelligence.
- 5. Set a verdict and record your reasoning.