Potential Password Spray Attack

Status: available
Severity: medium
Time window: 5m
Group by: City, Country, TimeGenerated, client_ipAddress_s
Source: github.com/Azure/Azure-Sentinel

This query searches for failed attempts to log into the Okta console from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110.003` Brute Force: Password Spraying

Telemetry coverage

Platform	Record / event type
Okta	System Log event type `user.session.start`: User logged in to Okta

Rules detecting the same action

These rules filter on the same operation.

Failed Logins from Unknown or Invalid User (Kusto)
First Occurrence of Okta User Session Started via Proxy (Elastic)
High-Risk Admin Activity (Kusto)
Multiple Okta Sessions Detected for a Single User (Elastic)
Multiple Okta User Authentication Events with Same Device Token Hash (Elastic)
New Device/Location sign-in along with critical operation (Kusto)
Okta AiTM Session Cookie Replay (Elastic)
Okta Login From CrowdStrike Unmanaged Device (Panther)

Rule body

id: e27dd7e5-4367-4c40-a2b7-fcd7e7a8a508
name: Potential Password Spray Attack
description: |
  This query searches for failed attempts to log into the Okta console from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: OktaSSO
    dataTypes:
      - Okta_CL
  - connectorId: OktaSSOv2
    dataTypes:
      - OktaSSO
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1110.003
query: |
  // Adjust threshold for failed logins to reduce noise
  let FailureThreshold = 15;
  let FailedEvents = OktaSSO
  | where eventType_s =~ "user.session.start" and outcome_reason_s in ("VERIFICATION_ERROR","INVALID_CREDENTIALS")
  | summarize dcount(actor_alternateId_s) by client_ipAddress_s, bin(TimeGenerated, 5m)
  | where dcount_actor_alternateId_s > FailureThreshold
  | project client_ipAddress_s, TimeGenerated;
  OktaSSO
  | where eventType_s =~ "user.session.start" and outcome_reason_s in ("VERIFICATION_ERROR","INVALID_CREDENTIALS")
  | summarize Users = make_set(actor_alternateId_s) by client_ipAddress_s, City = column_ifexists('client_geographicalContext_city_s', ""), Country = column_ifexists('client_geographicalContext_country_s', ""), bin(TimeGenerated, 5m)
  | join kind=inner (FailedEvents) on client_ipAddress_s, TimeGenerated
  | project TimeGenerated, client_ipAddress_s, Users, DistinctUsers = array_length(Users), City, Country
  | sort by TimeGenerated desc
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: client_ipAddress_s
customDetails:
  Users: Users
  City: City
  Country: Country
alertDetailsOverride:
  alertDisplayNameFormat: 'Potential password spray attack from IP {{client_ipAddress_s}}'
  alertDescriptionFormat: '{{DistinctUsers}} distinct users failed authentication from {{client_ipAddress_s}} in a 5 minute window.'
version: 1.1.2
kind: Scheduled

Stages and Predicates

Parameters

let FailureThreshold = 15;

Let binding: `FailedEvents` used in Stage 4

let FailedEvents = OktaSSO
| where eventType_s =~ "user.session.start" and outcome_reason_s in ("VERIFICATION_ERROR","INVALID_CREDENTIALS")
| summarize dcount(actor_alternateId_s) by client_ipAddress_s, bin(TimeGenerated, 5m)
| where dcount_actor_alternateId_s > FailureThreshold
| project client_ipAddress_s, TimeGenerated;

Stage 1: `source`

OktaSSO

Stage 2: `where`

| where eventType_s =~ "user.session.start" and outcome_reason_s in ("VERIFICATION_ERROR","INVALID_CREDENTIALS")

Stage 3: `summarize`

| summarize Users = make_set(actor_alternateId_s) by client_ipAddress_s, City = column_ifexists('client_geographicalContext_city_s', ""), Country = column_ifexists('client_geographicalContext_country_s', ""), bin(TimeGenerated, 5m)

Stage 4: `join`

| join kind=inner (FailedEvents) on client_ipAddress_s, TimeGenerated

Stage 5: `project`

| project TimeGenerated, client_ipAddress_s, Users, DistinctUsers = array_length(Users), City, Country

Stage 6: `sort`

| sort by TimeGenerated desc

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`dcount_actor_alternateId_s`	gt	`15`	`field:"dcount_actor_alternateId_s" kind:gt value:"15"`
`eventType_s`	eq	`user.session.start`	`field:"okta::eventType" kind:eq value:"user.session.start"`
`outcome_reason_s`	in	`INVALID_CREDENTIALS` `VERIFICATION_ERROR`	`field:"okta::outcome.reason" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`City`	`project`
`Country`	`project`
`DistinctUsers`	`project`
`TimeGenerated`	`project`
`Users`	`project`
`client_ipAddress_s`	`project`

Potential Password Spray Attack

MITRE ATT&CK coverage

Telemetry coverage

Rules detecting the same action

Rule body

Stages and Predicates

Parameters

Let binding: FailedEvents used in Stage 4

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: join

Stage 5: project

Stage 6: sort