TeamFiltration is a cross-platform framework used to enumerate Microsoft 365 and Microsoft Entra ID accounts and to perform credential-spraying and related identity operations. It focuses on cloud identities rather than endpoint malware, so the main evidence is usually in authentication telemetry such as sign-in logs, failed logins, and unusual source IP patterns.
In security operations, TeamFiltration matters because it can scale identity abuse across many tenants and accounts with relatively little noise. Attackers may use it to find valid accounts, test passwords against many users, and probe for weak or stale service accounts that still have privileges. Defenders can spot this activity by watching for bursts of repeated authentication failures, rare user agents, abnormal geographies, and access attempts against non-human identities. Hardening service accounts, enforcing MFA, and alerting on spray patterns are key controls against this class of attack.