Microsoft has significantly improved its password spray attack detection capabilities in Azure Active Directory (Azure AD) and has now detected twice as many compromised accounts, thanks to a new machine learning (ML) system
“This new machine learning-based detection method detects twice as many compromised accounts as the previous algorithm,” said Alex Weinert, Director of Identity Security at Microsoft.
“It does this while maintaining the previous algorithm's amazing 98% accuracy – meaning that if this algorithm says an account has been compromised via password spray, it's almost certain that it has been compromised“.
Machine learning is used to more effectively detect attacks
Microsoft has created an engine focused on detecting password spray attacks, and it has allowed the company to identify and notify hundreds of thousands of victims each month (350,000 in April 2018).
According to Bleeping Computer, this detection engine provides Azure AD customers with access feature Identity Protection (via an Azure AD Premium P2 license) when a attack password spray.
Now, Microsoft has improved the detection engine for Azure AD Identity Protection customers with a new machine learning system that uses known attack patterns and additional data to enhance the effectiveness of attack detection.
“This new method of detecting password spray attacks is a great example of how we use the information we gain from all of Microsoft’s systems to expand and improve our protections,” Weinert added.
Built-in Azure AD password spray protection
Cybercriminals often carry out password spray attacks via large botnets to gain access to accounts, combining usernames with, usually, weak passwords. Criminals can also hide failed attempts by using different IP addresses.
This also allows them to bypass automated defenses designed to block multiple failed connection attempts.
Azure AD Password Protection was released in April 2019 (in public preview since September 2019) to reduce the risks of password spray attacks, preventing users from choosing easy and weak passwords and drastically reducing the success rate of such attacks (to about 1%), says Weinert.
