PowerShell + Graph script to find accounts missing MFA in Entra

Fri, 21 Aug 2026 11:38:25 +0000

Engineer — Learn: Practical scripting technique for auditing MFA coverage gaps in Entra ID using Microsoft.Graph.Beta PowerShell; useful reference when validating rollout completeness but no vulnerability or patch action required.
SOC/IR — Skip
Leader — Skip

Password spraying attacks surge 155x as hackers exploit MFA gaps

Thu, 20 Aug 2026 11:39:11 +0000

Engineer — Plan: Audit all login flows for legacy authentication exposure and enforce MFA uniformly — the campaign scale (81M attempts in two weeks) confirms attackers are systematically targeting incomplete MFA coverage and legacy auth protocols. Disable legacy auth (SMTP AUTH, Basic auth, IMAP) in M365/Google Workspace and review Conditional Access or equivalent policies this quarter.
SOC/IR — Act: Tune SIEM for distributed low-and-slow authentication failures, particularly against legacy protocol endpoints (SMTP, IMAP, RDP, ADFS); run a hunt for accounts with high failed-login volume or successful logins following a spray pattern since the start of H1 2026. Password spraying maps to ATT&CK T1110.003 and is detectable via authentication log anomalies even without specific IOCs.
Leader — Plan: The 155x year-over-year increase from Huntress provides a quantified data point to accelerate legacy auth deprecation and full MFA rollout on the roadmap; use it to justify priority and budget before the next planning cycle, framing the gap in MFA coverage as a measurable risk rather than a configuration detail.