Signin Spray Shape

The blind spot

The obvious detector counts failures per account:

  if (failuresFor(user) >= 8) alert(user);

That catches a brute-force against one account — the attack people picture, not the attack people get. Spray is deliberately horizontal: three attempts against each of four hundred accounts, using the season-and-year passwords that always work somewhere. No account approaches eight failures, so the detector reports nothing. Lockout policy does not fire either, for the same reason. Both stay silent precisely because the attack is being run competently.

A test pins this rather than asserting it in prose — the same twelve-account dataset that triggers password_spray has a worst-case-per-account count of 1.

  detectSprayPatterns(events);
  // { kind: "password_spray", severity: "critical",
  //   detail: "12 accounts saw credential failures within 60m, at most 1 each —
  //            the horizontal shape a per-account threshold never trips." }

The window slides rather than bucketing by clock hour, so a burst straddling a boundary cannot land under the threshold in two adjacent buckets.

The second error, which inflates everything

errorCode !== 0 is not "a failed password". Directory logs record MFA challenges, interrupted flows and policy blocks with non-zero codes too, and those are the most common non-zero codes in a healthy tenant. Counting them does two things:

1. Buries real credential failures under an order of magnitude of noise — and the spray
   detector above runs on those counts, so its thresholds stop meaning anything.
2. **Misreads the most important event in the log.** mfa_required means the password was
   **correct** and only the second factor stood in the way. That is not a failed attack, it is a
   nearly-successful one. It deserves to be louder than a wrong password, not averaged in with it.

  classifySignIn(50126); // "invalid_credentials"  → counted
  classifySignIn(50076); // "mfa_required"         → NOT counted, escalated separately
  classifySignIn(50058); // "interrupted"          → not counted
  classifySignIn(53003); // "policy_blocked"       → not counted

What it reports

| kind | severity | meaning | |---|---|---| | successful_after_failures | critical | a guess landed. Stop reading, start responding | | password_spray | critical | many accounts, few attempts each, one window | | mfa_wall | high | password accepted, MFA held. Reset these — do not rely on MFA holding | | brute_force | high | one account hammered | | enumeration | medium | attempts against accounts that do not exist |

Findings, not a boolean, because these are different problems with different responses.

Scope and honesty

Error codes are Microsoft Entra's (ENTRA_CODES, exported and extensible). The detection logic is provider-neutral — map your provider's codes to the same Outcome union and everything downstream works. Nothing here is Entra-specific except the table.

What it does not do:

| not included | why | |---|---| | Fetching sign-in logs | you fetch; this analyses | | Impossible-travel / geo-velocity | needs a geo-IP database and a defensible speed model; a wrong one accuses travelling staff | | Blocking or locking accounts | analysis only — auto-lockout on a spray detector is a self-inflicted outage | | Deduplicating repeat alerts | findings-delta | | Mailbox rules the attacker left behind | inbox-rule-tripwire |

Thresholds are defaults (minDistinctUsers: 8, maxAttemptsPerUser: 5, burstThreshold: 8, windowMinutes: 60), not calibrated truth. A tenant of 30 people and a tenant of 30,000 want different numbers, and every one of them is an argument.

Timestamps are parsed with Date.parse, so feed it ISO 8601. Anything else is at the mercy of implementation-defined parsing, which fails silently rather than loudly.