Hunting for M365 Password Spraying | Huntress

This Huntress write-up analyzes password-spraying activity observed against Microsoft 365, describing attacker tradecraft (jitter/delays, use of cloud services to rotate IPs), example tools (TREVORspray, CredMaster, git-rotate), hunting queries and telemetry signals to detect credential theft, and recommended mitigations including blocking legacy authentication, implementing strong/ phishing-resistant MFA, and Entra password protection.