Open cardosec
Case DE8397 · Identity & AD · L2 Practitioner
Password Spray in Progress
Live alertOver 30 minutes, 900 accounts each had exactly one failed login from rotating residential IPs. Three accounts then logged in successfully.
- 01 What happened?
- 02 What is the impact?
- 03 What do you do?
What a strong answer covers
Try it out loud first. Then check yourself:
- Pattern = spray: one or two common passwords across many accounts to stay under lockout thresholds
- Priority is the three successes: force reset, revoke sessions, check MFA status and post-login activity
- Block with smart lockout, IP reputation and conditional access; residential proxies make IP blocks weak alone
- Check if legacy auth was hit: in Exchange Online, SMTP AUTH is the last basic-auth path, and basic auth bypasses MFA
- Prevent: banned-password lists, phishing-resistant MFA everywhere, and disable legacy protocols
Go deeper
cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.