SSO Password Spray

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Hour
Required Data	Requires: AzureAD Requires: Okta Requires: OneLogin
Detection Modules	Identity Analytics
ATT&CK Tactic	Credential Access (TA0006) Resource Development (TA0042)
ATT&CK Technique	Brute Force: Password Spraying (T1110.003) Brute Force: Password Guessing (T1110.001) Compromise Accounts (T1586)
Severity	Informational

Description

An abnormally high amount of SSO authentication attempts were seen within a short period of time.
This may have resulted from a login password spray attack.

Attacker's Goals

An attacker may be attempting to gain unauthorized access to user accounts.

Investigative actions

See whether this was a legitimate action.
Check if the user usually logs in from this country.
Check whether a successful login was made after unsuccessful attempts.

Variations

SSO Password Spray Threat Detected

Synopsis

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

Description

An abnormally high amount of SSO authentication attempts were seen within a short period of time.
This may have resulted from a login password spray attack.

Attacker's Goals

An attacker may be attempting to gain unauthorized access to user accounts.

Investigative actions

See whether this was a legitimate action.
Check if the user usually logs in from this country.
Check whether a successful login was made after unsuccessful attempts.

SSO Password Spray Activity Observed

Synopsis

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Description

An abnormally high amount of SSO authentication attempts were seen within a short period of time.
This may have resulted from a login password spray attack.

Attacker's Goals

An attacker may be attempting to gain unauthorized access to user accounts.

Investigative actions

See whether this was a legitimate action.
Check if the user usually logs in from this country.
Check whether a successful login was made after unsuccessful attempts.