Which system is an attacker targeting by running the following command? PS > Invoke-MSOLSpray -UserList ./users.txt -Password Clippers22

MSOLSpray (Microsoft Online Spray) sends a single password against a list of usernames to Azure AD's cloud authentication endpoints, which underpin Microsoft 365 services including Exchange Online, SharePoint, and Teams. By spraying one password at a time across many accounts, it attempts to evade per-account lockout policies while gaining unauthorized Microsoft 365 access.

MSOLSpray communicates exclusively with Microsoft's cloud-based authentication APIs over the internet and has no mechanism to target or enumerate Windows hosts on a local network subnet.

MSOLSpray contains no functionality for database attacks; it is purpose-built for Microsoft Online credential spraying and cannot interact with SQL server authentication protocols.

The tool bypasses on-premises Active Directory and local domain controllers entirely by authenticating directly against Azure AD cloud endpoints, making the local domain controller irrelevant to the attack.