Microsoft Office 365 Password Spraying SIEM Detection Test
Organizations should ensure their SIEMs are properly ingesting logs and events from all externally-facing applications, such as Office365.
How to Test Your SIEM Detections for O365 Password Spraying
MSOLSpray is a tool written to perform a password spray attack against users Office365 Account (from daft hack on GitHub).
Here’s an example from our engineering/security team at Blumira on how to test your password spraying detection for Windows OS/Active Directory, using DomainPasswordSpray:
- Download PasswordSpray.ps1 from https://github.com/dafthack/MSOLSpray
- Right-click PasswordSpray.ps1 > click “Run PowerShell as Admin”
- CD **directory where script has been saved**
- Get-ExecutionPolicy
- Set-ExecutionPolicy Unrestricted
- Import-Module .\DomainPasswordSpray.ps1
- Invoke-DomainPasswordSpray -UserList usernames.txt -Domain YOURDOMAIN.local -PasswordList usernames.txt -OutFile sprayed-creds.txt–
Additional Security Resources
View All Posts
Customer Success Stories
7 min read
| January 6, 2025
Customer Story: District of Sparwood
Read More
Blog
5 min read
| January 3, 2025
Microsoft Defender for Cloud Apps: Integrate with Blumira SIEM
Read More
Customer Success Stories
7 min read
| October 10, 2024