Wiki › Techniques, Tactics & Procedures (TTPs) › Initial Access › Password Spraying Attacks

Password Spraying Attacks

2 min read

Jump to:

Overview

Password spraying attacks are a credential-based technique where adversaries attempt to gain unauthorized access by systematically trying a small set of commonly used passwords against many user accounts. This approach is employed early in the attack lifecycle, often during initial access, to avoid account lockouts and detection mechanisms triggered by rapid, repeated login failures.

Attack Objective

Gain unauthorized access to user accounts by exploiting weak or reused passwords
Supports the Initial Access and Execution stages of the attack lifecycle
Advances the attacker’s position by establishing footholds within target environments for further exploitation or lateral movement

How the Technique Works

Adversaries select a limited set of common or default passwords and attempt to authenticate across a large number of accounts, distributing attempts to evade detection and avoid triggering account lockout policies. By targeting many accounts with few password guesses each, attackers reduce the likelihood of raising alarms while increasing the chance of compromising at least one account with weak credentials.

Common Methods & Variations

Use of widely known default or commonly used passwords such as “Password123” or “Welcome1”
Targeting on-premises Active Directory, cloud identity providers, or web-based authentication portals
Leveraging legitimate authentication protocols and tools (living-off-the-land) rather than custom brute-force software

Indicators of Compromise (IOCs)

Unusual authentication attempts across many accounts with a small set of passwords
Increased failed login events distributed over time and accounts
Authentication logs showing repeated login attempts from the same IP or device to multiple accounts
Alerts from identity providers or security tools indicating anomalous login patterns

Detection Strategies

Monitoring authentication logs from identity and access management systems
Behavioral detection focusing on distributed failed login attempts and deviations from normal user login patterns
Correlation of login attempts across accounts and time to identify low-and-slow attack patterns

Mitigation & Prevention

Enforcing strong password policies and multi-factor authentication (MFA) to reduce credential compromise risk
Implementing account lockout or throttling policies that balance security and usability
Regularly monitoring and auditing authentication events and user behavior
Educating users on password hygiene and the risks of password reuse

Response Considerations

Immediately block or disable compromised accounts and reset passwords
Investigate authentication logs to identify scope and origin of the attack
Assess potential lateral movement or privilege escalation following initial compromise
Enhance monitoring and harden authentication controls post-incident

Related Techniques

Brute Force: More aggressive password guessing against single accounts
Credential Dumping: Harvesting credentials for use in password spraying or other attacks
Lateral Movement: Using compromised credentials to access additional systems

Mapping & References

MITRE ATT&CK T1110.003 – Password Spraying
Public advisories and research on credential-based attacks and identity security best practices

Tags: Authentication Credential Attacks Cybersecurity Defense Identity Security Incident Response Initial Access MITRE ATT&CK Password Spraying Threat Detection