SSO Password Spray

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2025-10-27

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: AzureAD OR Azure SignIn Log OR Duo OR Okta OR OneLogin OR PingOne
Detection Modules	Identity Analytics
Detector Tags
ATT&CK Tactic	Credential Access (TA0006) Resource Development (TA0042)
ATT&CK Technique	Brute Force: Password Spraying (T1110.003) Brute Force: Password Guessing (T1110.001) Compromise Accounts (T1586)
Severity	Informational
Response playbooks	Variations of this detector that create incidents have an OOTB response playbook included in the Cortex Response and Remediation Pack

Description

An abnormally high amount of SSO authentication attempts were seen within a short period of time.
This may have resulted from a login password spray attack.

Attacker's Goals

An attacker may be attempting to gain unauthorized access to user accounts.

Investigative actions

See whether this was a legitimate action.
Check if the user usually logs in from this country.
Check whether a successful login was made after unsuccessful attempts.

Variations

SSO Password Spray Involving a Honey User

Synopsis

ATT&CK Tactic	Credential Access (TA0006) Resource Development (TA0042)
ATT&CK Technique	Brute Force: Password Spraying (T1110.003) Brute Force: Password Guessing (T1110.001) Compromise Accounts (T1586)
Severity	Medium
Response playbooks	SSO Password Spray

Description

An abnormally high amount of SSO authentication attempts were seen within a short period of time.
This may have resulted from a login password spray attack.

Attacker's Goals

An attacker may be attempting to gain unauthorized access to user accounts.

Investigative actions

See whether this was a legitimate action.
Check if the user usually logs in from this country.
Check whether a successful login was made after unsuccessful attempts.

SSO Password Spray Threat Detected

Synopsis

ATT&CK Tactic	Credential Access (TA0006) Resource Development (TA0042)
ATT&CK Technique	Brute Force: Password Spraying (T1110.003) Brute Force: Password Guessing (T1110.001) Compromise Accounts (T1586)
Severity	Medium
Response playbooks	SSO Password Spray

Description

An abnormally high amount of SSO authentication attempts were seen within a short period of time.
This may have resulted from a login password spray attack.

Attacker's Goals

An attacker may be attempting to gain unauthorized access to user accounts.

Investigative actions

See whether this was a legitimate action.
Check if the user usually logs in from this country.
Check whether a successful login was made after unsuccessful attempts.

SSO Password Spray Activity Observed

Synopsis

ATT&CK Tactic	Credential Access (TA0006) Resource Development (TA0042)
ATT&CK Technique	Brute Force: Password Spraying (T1110.003) Brute Force: Password Guessing (T1110.001) Compromise Accounts (T1586)
Severity	Low
Response playbooks	SSO Password Spray

Description

An abnormally high amount of SSO authentication attempts were seen within a short period of time.
This may have resulted from a login password spray attack.

Attacker's Goals

An attacker may be attempting to gain unauthorized access to user accounts.

Investigative actions

See whether this was a legitimate action.
Check if the user usually logs in from this country.
Check whether a successful login was made after unsuccessful attempts.