HighIdentity & AccessA07:2021 – Identification and Authentication Failures
Attackers try a few common passwords against many accounts, staying under per-account lockout thresholds, to find any account with a weak or reused password.
Immediate Response
1Block the source IPs and networks at the identity provider or WAF.
2Reset passwords for accounts that signed in successfully during the spray.
3Review those accounts for mailbox rules, new MFA methods, and data access.
