Password Spraying Explained

Password spraying tests a few weak passwords across many accounts, dodging lockouts; Microsoft ties over a third of compromises to it. Covers delayed and Kerberos pre-auth variants plus detection.

Password spraying trades many passwords on one account for a few common ones across many, evading lockouts and monitoring. The AD Security 101 guide covers risks, detection, and defenses like MFA.

MFA for AD is challenging: native support is smartcards only, so organizations layer Windows Hello for Business or Duo on endpoints. Covers on-prem and hybrid options including Entra Connect.

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Three OAuth techniques attackers use in Azure, and how Entra ID sign-in logs and JWT claims expose them; includes Wiz telemetry on prevalence and ready-to-use KQL detection queries.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.