> For the complete documentation index, see [llms.txt](https://nk0.gitbook.io/dfir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nk0.gitbook.io/dfir/enterprise-architecture/the-cloud/azure/attacking-azure/initial-access/password-spraying-m365.md).

# Password Spraying M365

## Attack

{% embed url="<https://github.com/dafthack/MSOLSpray>" %}

* M365 password spraying attacks can have 10 failed login attempts per 1 minute.
* Legacy authentication is disabled by default (Companies still enable it based on business needs).

{% embed url="<https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online>" %}
Legacy Auth
{% endembed %}

### MSOLSpray:

* Sends POST request to *<http://login.microsoftonline.com/common/oauth2/v2.0/token>* with username and password
* POST request leaks info about whether user exists, password is correct, MFA is enabled or conditional access policies are applied

```powershell
Import-Module MSOLSpray.ps1
Invoke-MSOLSpray -UserList .\userlist.txt -Password Winter2020
```

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FAkAAThdtUvpBaM0njCNi%2Fimage.png?alt=media&amp;token=01c84a52-fe01-4fdf-877c-99f5c4f1a689" alt=""><figcaption><p>Failure and Success of MSOLspray</p></figcaption></figure>

## Detect

* Successful logons of MSOLSpray will show up in interactive, but not necessarily mean that they logged into the account. Especially if MFA is enabled.
* Failed Logon attempts happening within seconds for multiple accounts.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FnWbj4OcR1hAjAYGjaxTp%2Fimage.png?alt=media&amp;token=d9146aac-7693-441e-aff9-8d1991330430" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2Fw0nfnoXgslwqongSuHr9%2Fimage.png?alt=media&amp;token=7c622003-a2e6-467e-b821-530ec2aa9934" alt=""><figcaption></figcaption></figure>

* The resource ID 00000002-0000-0000-c000-000000000000 is Active Directory PowerShell in Azure and is used by ADrecon, AADInternals, MSOLSpray, and many more.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FQQpT7rm9ovUWLAST5Ce2%2Fimage.png?alt=media&amp;token=9602928d-da22-4d83-bd83-0f164b340d36" alt=""><figcaption></figcaption></figure>

{% embed url="<https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in>" %}

{% embed url="<https://www.shawntabrizi.com/aad/common-microsoft-resources-azure-active-directory/>" %}

* A successful logon for an MFA enabled account requires two successful logon events
  * Correct Password.
  * MFA Completed in Azure.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FjnVKYGmj4yWEEAWvjwtd%2Fimage.png?alt=media&amp;token=5f5edb97-7687-4cc2-8637-9616c82b2ec4" alt=""><figcaption><p>Successful</p></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FgNaGTCxZUicMdY7eRLPp%2Fimage.png?alt=media&amp;token=340e003a-1581-41a5-b0f4-f3b6ab3d34c2" alt=""><figcaption><p>Failed</p></figcaption></figure>

## Mitigate

* Enabled MFA on all endpoints (This will allow for detection of sign-ins without MFA too).
* Do not enable legacy authentication.
* Enforce complex passwords and strong password reset policy.
* Set up conditional access policies and lockdown logons to where the user lives.

**How to properly reset a compromised password:**

{% embed url="<https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/responding-to-a-compromised-email-account?view=o365-worldwide>" %}

{% embed url="<https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/reset-passwords?view=o365-worldwide#reset-my-admin-password>" %}