Even MOAR Powershell, looking at Entra logins - the good, the bad and the password sprays

1. Executive summary

A SANS Internet Storm Center (ISC) diary entry details practical techniques for querying Microsoft Entra ID (formerly Azure AD) sign-in audit logs via the Microsoft Graph PowerShell module to identify password spray attacks and anomalous successful logins. The author reports discovering multiple active password spray attacks during client engagements using these methods, which led to the tightening of Conditional Access policies. EMEA financial services organisations heavily reliant on Entra ID for identity should immediately adopt these log review practices to detect credential abuse and satisfy operational resilience requirements.

2. Regulatory framing

3. Technical analysis & attack chain

This item is a defensive methodology and threat observation report rather than a specific vulnerability or named threat campaign. The attack chain described is the generic pattern of a password spray attack against cloud identity providers, observed by the author during client engagements.

1. Initial access attempt: Attackers target Entra ID authentication endpoints (e.g., OWA) using password spray techniques. The source specifically notes the presence of "IP address with malicious activity" alerts in the sign-in logs, which indicates the use of rotating proxy services by attackers.
2. Credential validation: Attackers attempt to authenticate using a common password against multiple accounts.
3. Account lockout: Sustained spraying triggers account lockouts, visible in the sign-in logs as a specific failure reason.
4. Anomalous successful logins: The author notes the presence of successful logins (status/errorCode eq 0) originating from unexpected countries, including IPv6 addresses, indicating potential successful credential compromise or unauthorised access.

Defensive methodology

The author provides specific PowerShell commands using the Microsoft.Graph.Reports module to query the Get-MgAuditLogSignIn endpoint.

• Prerequisites: Import-Module Microsoft.Graph.Reports and Connect-MgGraph -Scopes "AuditLog.Read.All", "Directory.Read.All".
• Failed login extraction: The command Get-MgAuditLogSignIn -Filter "status/errorCode ne 0" -All is used to extract failed logins, parsing Location.City, Location.State, Location.CountryOrRegion, and Status.FailureReason.
• Anomalous success detection: The command Get-MgAuditLogSignIn -Filter "status/errorCode eq 0" -All is used to extract successful logins, which are then filtered against an array of expected countries ($ExpectedCountries = @("CA", "US")) to identify anomalous geographical access.

Confidence caveat: The observation of "multiple password spray attacks" is single-sourced to the author's client engagements; verify your own Entra ID logs before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Execute the provided Microsoft Graph PowerShell queries against your Entra ID tenant to extract failed and successful sign-in logs.
• Review failed logins (status/errorCode ne 0) for high volumes of failures across multiple UserPrincipalName values from a single IPAddress or CountryOrRegion, which indicates a password spray.
• Review successful logins (status/errorCode eq 0) originating from countries outside your expected operational footprint.

P2 — Within 72 hours

• Based on the log analysis, tighten Entra ID Conditional Access policies. Specifically, implement or refine geographic fencing to block logins from unexpected countries.
• Ensure "IP address with malicious activity" alerts are routed to your SIEM and trigger automated blocking or elevated authentication requirements (e.g., MFA challenge).

P3 — Within 7 days

• Automate the execution of the Get-MgAuditLogSignIn queries on a scheduled basis (e.g., daily) and feed the output into your SIEM for continuous monitoring and alerting.
• Review and enforce account lockout policies in Entra ID to ensure they trigger appropriately under spray conditions without causing operational denial of service.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes) are available in the source material.

Behavioural indicators

6. Detection

rule Entra_Password_Spray_Log_Analysis
{
    meta:
        author = "Adverse Trace"
        date = "2026-08-21"
        reference = "https://isc.sans.edu/diary/rss/33268"
        description = "Detects PowerShell scripts querying Entra ID sign-in logs for password spray analysis"
    strings:
        $module = "Microsoft.Graph.Reports" ascii
        $cmd = "Get-MgAuditLogSignIn" ascii
        $filter_fail = "status/errorCode ne 0" ascii
        $filter_success = "status/errorCode eq 0" ascii
        $scope = "AuditLog.Read.All" ascii
    condition:
        3 of them
}

title: Suspicious Entra ID Sign-In Activity
id: 7a8b9c1d-2e3f-4a5b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects password spray patterns and anomalous successful logins in Entra ID sign-in logs
author: Adverse Trace
date: 2026/08/21
references:

    - https://isc.sans.edu/diary/rss/33268
logsource:
    product: microsoft
    service: entra_id_signin
detection:
    selection_spray:
        ResultType: ne 0
        RiskEventTypes:

            - 'unfamiliarFeatures'
            - 'investigationsThreat'
    filter_expected_countries:
        Location.CountryOrRegion:

            - 'CA'
            - 'US'
    selection_anomalous_success:
        ResultType: eq 0
        Location.CountryOrRegion:

            - null
    condition: selection_spray or (selection_anomalous_success and not filter_expected_countries)
falsepositives:

    - Legitimate user travel
    - VPN concentrator egress in unexpected country
level: medium

7. Sources

• SANS Internet Storm Center (ISC), "Even MOAR Powershell, looking at Entra logins - the good, the bad and the password sprays", https://isc.sans.edu/diary/rss/33268, 2026-08-21

8. Adverse Trace position

This advisory highlights a critical operational gap: many organisations fail to actively monitor cloud identity logs post-migration. The techniques described are practical, immediately actionable, and leverage existing Microsoft Graph APIs. For EMEA financial services, the detection of password spray attacks via Entra ID logs is not just a security best practice but a component of operational resilience under DORA. We assess the risk of credential compromise via password spraying as high for tenants without robust Conditional Access policies and active log monitoring. We will continue to provide actionable detection rules for cloud identity threats and advise clients to integrate these queries into their standard SOC operations.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.