Analytics
Informational
✕
IP Rotation Pattern in SSO Spray
A high volume of SSO authentication attempts was observed in a short time window. This behavior may indicate a password spray attack targeting multiple accounts.
- Module:
- Identity Analytics
- Data source:
- AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne
ATT&CK tactics: Credential Access (TA0006) Resource Development (TA0042)
ATT&CK techniques: Brute Force: Password Spraying (T1110.003) Brute Force: Password Guessing (T1110.001) Compromise Accounts (T1586)
Attacker's goals:
An attacker may be attempting to compromise user accounts through unauthorized access attempts.
Investigative actions:
Determine if the activity was performed by a legitimate user. Check for any successful logins that occurred following a series of failed attempts. Investigate the AS organization and evaluate the ASN's reputation for malicious activity. Review historical login behavior from the same IP addresses or ASN. Validate whether MFA was triggered or bypassed during the authentication attempts.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day
2 variations:
- Potential Targeted SSO Password Spray Activity Detected Medium (parent: Informational)
- Suspicious SSO Login Attempts from Multiple IPs Low (parent: Informational)