Entra Log Analysis: Detecting Password Spray Attacks with PowerShell

Detecting Entra Password Spray Attacks and Anomalous Logins

The shift to cloud-based identity services, such as Microsoft Entra ID (formerly Azure Active Directory), necessitates a corresponding evolution in security monitoring practices. While organizations diligently monitored on-premise authentication logs, this vigilance often wanes in cloud environments. However, these logs are a rich source of threat intelligence, particularly for identifying common attack vectors like password spraying and unauthorized access.

The Criticality of Entra Sign-in Log Analysis

Many organizations leverage Entra ID for authentication across their ecosystem. Consequently, sign-in logs hold crucial insights into potential compromise attempts. As highlighted by SANS ISC, failing to regularly review these logs can leave significant blind spots. Attackers frequently target these services with automated credential stuffing or password spray attacks, attempting to gain initial access. Furthermore, successful logins from unexpected geographical locations can signal a breach or compromised account.

How to detect password spray attacks in Entra ID involves actively querying and analyzing failed login attempts. To begin, security professionals require the Microsoft.Graph.Reports module and appropriate permissions. After importing the module, connect using Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All".

Leveraging PowerShell for Threat Detection

To uncover patterns indicative of password spray activity, defenders can filter for failed logins. The SANS ISC diary provides a practical PowerShell script to analyze Entra sign-in logs:

Get-MgAuditLogSignIn -Filter "status/errorCode ne 0" -All | Select-Object `
    CreatedDateTime, `
    UserPrincipalName, `
    IPAddress, `
    @{Name="City"; Expression={$_.Location.City}}, `
    @{Name="State"; Expression={$_.Location.State}}, `
    @{Name="Country"; Expression={$_.Location.CountryOrRegion}}, `
    @{Name="FailureReason"; Expression={$_.Status.FailureReason}}

This command extracts critical data points like UserPrincipalName, source IPAddress, geographical Location, and the FailureReason. In a password spray scenario, defenders would typically observe:

• Numerous failed login attempts targeting multiple user accounts over a short period.
• Attempts originating from a range of IP addresses, often indicating the use of proxy services or botnets.
• FailureReason entries like “Invalid username or password” or “Authentication failure.”
• Eventually, account lockouts for targeted users, signaling the attacker’s progression or the effectiveness of protection mechanisms. The SANS author noted finding “IP address with malicious activity” alerts, often linked to rotating proxy services.

Identifying Unexpected Successful Logins in Azure AD

Beyond failed attempts, identifying unexpected successful logins Azure AD is equally vital. A successful login from an unusual country or region can be a strong indicator of a compromised account. To detect this, another PowerShell approach involves filtering for successful logins and then excluding expected countries:

# set the array of "expected" Countries
$ExpectedCountries = @("CA", "US") # Customize for your organization's legitimate access points

#Get all successful logins
$f = Get-MgAuditLogSignIn -Filter "status/errorCode eq 0" -All | Select-Object `
    CreatedDateTime, `
    UserPrincipalName, `
    UserDisplayName, `
    AppDisplayName, `
    ResourceDisplayName, `
    IsInteractive, `
    IPAddress, `
    @{Name="Country"; Expression={$_.Location.CountryOrRegion}}, `
    @{Name="FailureReason"; Expression={$_.Status.FailureReason}}

# remove expected countries, and what is left is unexpected
$f | Where { $_.Country -notin $ExpectedCountries } | Out-GridView

This script helps pinpoint anomalous successful authentications, allowing security teams to investigate immediately.

Actionable Recommendations for Entra Security

Organizations should integrate these log analysis techniques into their routine security operations to bolster their defenses against identity-based attacks.

• Implement Regular Log Review: Establish a schedule for reviewing Entra sign-in logs, focusing on both failed attempts and successful logins from unexpected sources. Automation via scripting can streamline this process significantly.
• Refine Conditional Access Policies: Use insights gleaned from log analysis to strengthen conditional access policies. For example, block access from known malicious IP ranges or unusual geographic locations, especially for administrative accounts or sensitive applications. The SANS author noted that their client tightened conditional access policies after detecting password spray attacks.
• Enable Multi-Factor Authentication (MFA): Ensure MFA is enforced for all users, particularly for privileged accounts. While log analysis helps detect attacks, MFA acts as a critical preventive control against credential theft.
• Educate Users: Inform users about the risks of password spraying and the importance of strong, unique passwords.

By proactively analyzing Entra sign-in logs, security teams can detect and respond to credential-based attacks more effectively, significantly improving their overall security posture.

Related: Defending Entra ID: Lessons from Breach at the Beach CTF, Auditing Entra ID MFA Gaps with PowerShell and Microsoft Graph