Skip to main content

Password-Spray Correct-Password Detections

Sysadmin
Sysadmin
Fluency Sysadmin

A detection release for password sprays against Microsoft 365, published October 30 and 31, 2026. Two new high-severity rules alert when a sign-in presents the user's correct password from a password-spray client, or when Smart Lockout refuses a correct password from a network the user never signs in from. Both work without Microsoft Entra ID P2. Two existing rules are sharpened. Together they answer the low-and-slow spray Fluency has seen in 42 of 104 monitored Microsoft 365 tenants since October 1, 2026, described in the advisory.

No action is needed: the rules sync to every instance automatically.

Rollout and requirements​

  • Rollout. All four rules are published to the default rule set and reach each instance through resource sync within about two hours. No configuration is needed. They apply to sign-ins from release on, not retroactively; to look back, use the queries in the advisory.
  • Data sources. All four read the Entra ID sign-in logs, collected by Entra ID Audit via Event Hubs or Microsoft Graph. The two new rules read interactive and non-interactive sign-ins; non-interactive sign-ins arrive only through Event Hubs. EntraID_Valid_Password_Blocked reads interactive sign-ins.
  • Entra ID P2. The two new rules need no P2: they read the result of the password check, which every tenant's sign-in log records. EntraID_Valid_Password_Blocked matches Conditional Access blocks in any tenant, but its new MFA case needs Microsoft's sign-in risk rating, which the logs carry only for users with an Entra ID P2 licence. EntraID_High_Risk_SignIn needs P2 as before.
  • Expected volume. EntraID_Spray_Client_Correct_Password was checked against 30 days of sign-ins in 104 tenants, where its user agents never had a successful sign-in. EntraID_Correct_Password_Lockout_New_Network, replayed on 30 days of sign-ins in 52 tenants, gave about 60 alerts a month across all of them, almost all confirmed attacker sign-ins. In its first day live it raised six alerts, all on accounts already known to be compromised, and caught two sign-ins EntraID_Spray_Client_Correct_Password cannot see because they did not use the spray user agent.

The attack​

Since at least October 1, 2026, a password spray has tried one password per account from a fresh IP address almost every time: in one tenant, 2,173 addresses in 30 days, 92% of them used once. It targets interactive browser sign-ins to One Outlook Web with a single fixed user agent, and part of the traffic comes from OpenBullet / SilverBullet credential-stuffing configs. No per-IP or per-account threshold sees it.

In October the attacker entered the correct password for accounts in several customer tenants. Each of those sign-ins ended at an MFA prompt the attacker could not answer (50074 / 50076) or in Smart Lockout (50053). The attacker then retried the passwords it held from other countries and other clients: Azure CLI, SMTP basic authentication and a Go client.

Before this release, a correct password that ended at an MFA prompt or in a lockout raised an alert only where Entra ID Protection rated the sign-in high risk, which takes Entra ID P2. EntraID_Valid_Password_Blocked covered Conditional Access blocks, but not an unmet MFA prompt or a lockout.

New and changed detections​

IDRuleChangeSeverityFires when
102189EntraID_Correct_Password_Lockout_New_NetworkNew (October 31)HighSmart Lockout refuses (50053) a sign-in that presented the user's correct password, interactive or not, from a network (ASN) the user has had no successful sign-in from in the last 30 days. Any client or user agent.
102187EntraID_Spray_Client_Correct_PasswordNewHighA sign-in, interactive or not, presents the user's correct password from one of the two password-spray user agents below, whatever the result: success, MFA required, locked out or blocked.
102127EntraID_Valid_Password_BlockedImprovedMediumConditional Access stops an interactive sign-in that presented the user's correct password. As before, a block (53003, 53000, 53001, 530032). New: a sign-in held at an MFA requirement it did not meet (50074 with Conditional Access status failure) that Entra ID Protection rated low, medium or high risk.
102128EntraID_High_Risk_SignInImprovedHighEntra ID Protection rates a sign-in high risk at sign-in time. It no longer raises a second alert when Entra re-sends the same sign-in after the risk is remediated, dismissed or confirmed safe.

EntraID_Spray_Client_Correct_Password matches these two user agents exactly:

  • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, with nothing after 537.36. Real browsers continue it with (KHTML, like Gecko) Chrome/... Safari/....
  • <RndUA>, angle brackets included: the unfilled random-user-agent placeholder of an OpenBullet / SilverBullet config. No browser sends it.

Context rules​

IDRuleRecords
102188EntraID_Password_LockoutA sign-in that Smart Lockout refused (50053) whose authentication steps show the correct password, interactive or not. Feeds EntraID_Correct_Password_Lockout_New_Network and raises nothing itself.

What each rule does not cover​

EntraID_Correct_Password_Lockout_New_Network does not fire for:

  • a lockout with a wrong password, such as a phone or mail client with an old saved password;
  • a network the user had a successful sign-in from in the last 30 days. While a spray runs, Smart Lockout also refuses the user's own sign-ins, but from networks the user signs in from;
  • Microsoft's own network or the tenant's trusted named locations;
  • a correct password that MFA or Conditional Access stopped without a lockout. EntraID_Valid_Password_Blocked covers Conditional Access, and EntraID_Spray_Client_Correct_Password covers the spray clients at any result;
  • a second lockout of the same user from the same network on the same day.

It is keyed on the user and alerts at most once per user and network a day. Each alert names the IP address, network (ASN), country and city, user agent, application and client app, whether the sign-in was interactive, the authentication methods, the risk level, the named location, the correlation and sign-in IDs, and the networks the user is known to sign in from.

EntraID_Spray_Client_Correct_Password does not fire for:

  • the spray clients with a wrong password, which is most of the spray;
  • any other user agent, including a real browser's. A spray client that changes its user agent is left to EntraID_Correct_Password_Lockout_New_Network when Smart Lockout stops it;
  • copies of a sign-in that Entra re-sends after the risk is remediated, dismissed or confirmed safe.

It is keyed on the user. Each alert names the application and resource, IP address, country, network (ASN), result code and failure reason, client app, protocol, user agent, operating system, risk level and sign-in ID.

The new MFA case of EntraID_Valid_Password_Blocked does not fire for:

  • sign-ins with no risk rating, such as a user who leaves an MFA prompt unanswered, or any sign-in by a user without Entra ID P2;
  • copies Entra re-sends after the risk is dismissed or confirmed safe;
  • blocks of an existing session token (a travelling user whose phone reuses a token).

Triage guidance​

Treat an alert from either new rule, or from EntraID_Valid_Password_Blocked, as a compromised password, even though the sign-in failed.

  1. Contain first. Reset the password and revoke the user's sessions (Entra admin center → Users → the user → Revoke sessions).
  2. Confirm with the user. Ask whether they recognize the network, country and client. A device with an old saved password fails with the wrong password, from the user's own home and mobile networks; these alerts need the correct password, from a spray client or a network the user does not use.
  3. Review the account since the first correct-password attempt. Check the user's successful sign-ins, including non-interactive ones, and changes to the account: new MFA methods, newly registered devices, app consents, inbox rules and mail forwarding.
  4. Close the paths that skip MFA. Block legacy authentication and SMTP AUTH, and restrict Azure CLI, Azure AD PowerShell and the password-only (ROPC) flow to administrators. Make sure the user has an MFA method registered.
  5. Look for other targets. The spray reaches many users in a tenant. Search for the same rules on other users.

To find these alerts, search behavior events by rule name. Each rule is also listed by name on the Behavior Rules page (v1: Behavior Rules).

References​