What Is Password Spraying? Attacks, Detection and Defense

Password spraying is a brute force attack in which an attacker tries one or a few common passwords against many accounts, instead of many passwords against one account. Because each account sees only a handful of failures, the attack stays under lockout thresholds. MITRE ATT&CK tracks it as T1110.003. Microsoft disclosed in January 2024 that Midnight Blizzard used a password spray to compromise a test account without MFA. Sprays are caught by looking across accounts in sign-in logs and events 4625 and 4771, and stopped with MFA, blocked legacy authentication and banned-password lists.

What Is Password Spraying?

Most organizations protect each account with a lockout rule: after a set number of wrong passwords, the account is blocked for a while. Password spraying is designed around that rule. Instead of hammering one account, the attacker takes a long list of usernames and tries the same likely password against every one of them, then waits and tries the next password.

The MITRE ATT&CK page for Password Spraying (T1110.003) describes the attacker using "a single or small list of commonly used passwords against many different accounts" to avoid the lockouts that brute forcing a single account would cause. It is a sub-technique of Brute Force (T1110) under the Credential Access tactic, and ATT&CK lists it on Windows, Linux, macOS, identity providers, SaaS, Office suites, IaaS, containers, network devices and ESXi.

The logic is simple arithmetic. In an organization of a few thousand people, it only takes one person using a password like the current season and year, the company name with a number, or a common base word, for the attacker to get in. One valid account is often enough to read mail, register a device, plant persistence or start moving through the network.

How a password spraying attack works

At a high level, a spray goes through six stages:

1. Build a user list. Attackers guess usernames from email formats, public staff names, or directory data they already hold.
2. Pick a few passwords. They choose a short list of passwords that many people are likely to use.
3. Spray low and slow. Each account gets one or two attempts per round, and rounds are spaced out over hours or days. ATT&CK notes that adversaries "deliberately throttle" sprays to avoid alerting.
4. Hide the source. Attempts come from residential proxies, compromised home routers or rotating IP addresses, so no single IP stands out.
5. Aim at weak doors. Sprays favor sign-in paths that do not enforce MFA, such as legacy authentication protocols, test tenants, service accounts and dormant accounts.
6. Use the valid account. A successful sign-in becomes the foothold for everything that follows.

ATT&CK lists the services sprays commonly target, including SSH, SMB, LDAP, Kerberos, RDP, web management interfaces, databases, single sign-on and cloud-federated authentication, and externally facing email such as Office 365. This guide describes the technique conceptually; it does not include spraying commands, tools or password lists.

Password Spraying vs Brute Force vs Credential Stuffing

All three are password-guessing attacks grouped under ATT&CK T1110, but they guess in different patterns and need different defenses.

Password cracking (T1110.002) is the fourth sibling and works offline against stolen hashes, so it never touches a login page. Our credential stuffing statistics cover how often reused passwords are abused, and our password statistics show how common weak and reused passwords still are.

The practical difference for defenders: brute force is visible on one account, credential stuffing is visible as many logins with valid usernames from bot infrastructure, and password spraying is only visible when you look across many accounts at once.

Why Password Spraying Still Works

Password spraying is an old technique, but four conditions keep it effective.

Lockout thresholds are per account

Lockout counts failures per account. An attacker who knows the threshold can stay under it indefinitely. As an illustrative example: with a lockout threshold of 10 failures, an attacker who tries one password per account per day could test hundreds of candidate passwords across every account in a year without locking anyone out. Microsoft reported in October 2024 that, in about 80 percent of cases, the CovertNetwork-1658 spraying infrastructure made only one sign-in attempt per account per day.

Microsoft Entra smart lockout narrows this gap. By default it locks an account after 10 failed attempts in Azure public cloud tenants and three in Azure US Government tenants, starts with a one-minute lockout that grows on repeated failures, keeps separate counters for familiar and unfamiliar locations, and ignores repeats of the last three bad password hashes so a user retyping the same wrong password is not locked out. It also blocks sign-ins it identifies as malicious from IP traffic and anomalies. It still cannot see an attack that stays below the threshold on every account, which is why detection has to look across accounts.

Weak passwords are still common

A spray needs only one hit. Microsoft explains in its Entra Password Protection documentation that most sprays submit "only a few of the known weakest passwords" against each account, which is exactly why a banned-password list that blocks those base words at password change time is effective.

Legacy authentication skips MFA

Older protocols such as basic authentication for mail clients cannot perform MFA. Microsoft states in its guidance on blocking legacy authentication that, based on its analysis, more than 99 percent of password spray attacks use legacy authentication protocols.

Some accounts have no MFA by design

Service accounts, test accounts and dormant accounts often sit outside MFA policies. The CISA, NSA and partner advisory AA24-057A notes that service accounts have no human user behind them, so they "cannot be easily protected" with MFA, and that they are often highly privileged. Privileged service accounts are also the usual target of Kerberoasting; see how internal penetration tests check for Kerberoasting.

Real Password Spraying Attacks

The campaigns below come from primary sources: the affected vendor's own disclosure or a government advisory.

Midnight Blizzard and Microsoft (2023 to 2024)

On January 19, 2024, the Microsoft Security Response Center disclosed that it had detected a nation-state attack on its corporate systems on January 12, 2024. Beginning in late November 2023, Midnight Blizzard, the Russian state-sponsored actor also known as Nobelium, used a password spray to compromise a legacy, non-production test tenant account. It then used that account's permissions to access a very small percentage of Microsoft corporate email accounts, including senior leadership and security and legal staff, and exfiltrated some emails and attachments. Microsoft stated that the attack was not the result of a vulnerability in its products.

Microsoft Threat Intelligence published guidance for responders on January 25, 2024. It explained that the account did not have MFA enabled, that the actor used a low number of attempts against a limited number of accounts to avoid detection and account blocks, and that attempts came from distributed residential proxy infrastructure, which made IP-based indicators unreliable. From the foothold, the actor found a legacy test OAuth application with elevated access and used it to grant itself mailbox access.

The lesson is not that spraying is sophisticated. It is that one forgotten account outside normal policy is enough, and that low-volume sprays from residential IPs defeat simple per-IP and per-account rules.

CovertNetwork-1658 and Storm-0940 (2023 to 2024)

Microsoft's October 31, 2024 report describes a network of compromised small office and home office routers, mostly TP-Link devices, used to run highly evasive sprays since August 2023. Microsoft observed one sign-in attempt per account per day in about 80 percent of cases and warned that monitoring for multiple failed sign-ins from one IP address or to one account will not detect this activity. Credentials gathered this way were used by several Chinese threat actors, including Storm-0940.

Peach Sandstorm (2023)

In its September 14, 2023 report, Microsoft described an Iranian nation-state group spraying thousands of organizations between February and July 2023, with a focus on the satellite, defense and pharmaceutical sectors. The sprays came from Tor IP addresses and clustered almost entirely between 9:00 AM and 5:00 PM Iran Standard Time in late May and June, a reminder that the timing of failures can be a detection signal in itself.

Iranian actors and critical infrastructure (CISA AA24-290A)

The joint advisory AA24-290A, released October 16, 2024 by the FBI, CISA, NSA and Canadian and Australian partners, reported that since October 2023 Iranian actors had used password spraying and MFA push bombing to compromise accounts in healthcare, government, IT, engineering and energy organizations. Once inside, they frequently registered their own devices for MFA to keep access. MFA push bombing is covered in our guide to MFA fatigue attacks.

Password Spraying in MITRE ATT&CK (T1110.003)

ATT&CK is the common language most detection teams use to map attacker behavior; our MITRE ATT&CK framework guide explains how tactics, techniques and sub-techniques fit together. The T1110.003 page (version 1.8, last modified October 24, 2025) gives defenders four useful things.

• Procedure examples. Groups recorded as using password spraying include APT28 (G0007), APT29 (G0016), APT33 (G0064), HAFNIUM (G0125) and Chimera. ATT&CK records that APT28 used tooling that sprayed roughly four attempts per hour per account over days or weeks.
• A detection caveat. Sprays over LDAP and Kerberos are less likely to trigger the Windows logon failure event 4625, so detection cannot rely on that event alone.
• Mitigations. Account Use Policies (M1036), Multi-factor Authentication (M1032) and Password Policies (M1027).
• A detection strategy. DET0487, "Distributed Password Spraying via Authentication Failures Across Multiple Accounts," with analytics for Windows, Linux, network devices, containers, mail and SaaS sign-in failures.

A successful spray usually leads straight into other ATT&CK techniques: Valid Accounts: Cloud Accounts (T1078.004) for the foothold, MFA request generation (T1621) and device registration (T1098.005) to keep access, as both CISA advisories describe, and then lateral movement once the attacker has a working account inside the network.

How to Detect Password Spraying

A spray is designed to look like ordinary typos on each individual account. It only becomes visible when you aggregate failures across accounts, sources and time.

Microsoft's documentation explains what each source records. The Entra error code reference defines 50126, 50053 and 50034. Event 4771 is generated only on domain controllers, and Microsoft notes that a run of 0x18 failures can indicate a brute force attack. Event 4625 is logged on the computer where the logon attempt was made, and Microsoft suggests watching for runs of 0xC000006A (bad password) on critical and service accounts and 0xC0000064 (bad user name) as a sign of user enumeration. The Password spray risk detection requires Microsoft Entra ID P2 and fires only when an attacker successfully validates a user's password, so treat it as a confirmed compromise of that password, not an early warning.

Four patterns to hunt for

1. One source, many users. Failures for many different accounts from one IP address or ASN within an hour.
2. Many sources, same rhythm. Failures spread across many IPs but clustered in time against many accounts, which is what residential proxy and router-based sprays look like.
3. Rounds on a timer. Each account tried once per round, with rounds repeating at a steady interval.
4. Success after the wave. A successful sign-in, especially without MFA, from a source that just failed against other users.

A starting hunting query for Microsoft Sentinel

The query below is a defensive starting point for the first pattern in a workspace that ingests Entra ID sign-in logs. The thresholds are illustrative; tune them to your tenant's size and normal failure rate.

// Many distinct users failing with a bad password from one IP in one hour
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == "50126"
| summarize FailedUsers = dcount(UserPrincipalName),
            Attempts = count(),
            Apps = make_set(AppDisplayName, 10)
            by IPAddress, bin(TimeGenerated, 1h)
| where FailedUsers >= 10 and Attempts <= FailedUsers * 2
| order by FailedUsers desc

The Attempts <= FailedUsers * 2 condition keeps the focus on wide, shallow failures rather than one user mistyping repeatedly. This query will not catch a spray spread across thousands of residential IPs, so pair it with a tenant-wide view of failures per hour across all sources, and with a check for successful sign-ins from any IP that appears in its results.

Respond to a confirmed spray

Microsoft's Midnight Blizzard guidance gives a short response checklist: reset the passwords of accounts targeted in the spray, investigate further if any targeted account had system-level permissions, use risk detections to force MFA or a password change on risky sign-ins, and review what any successfully accessed account did next, including new MFA methods, device registrations, OAuth consents and mailbox rules.

How to Prevent Password Spraying

Prevention works best when it removes the conditions a spray depends on: guessable passwords, sign-in paths without MFA, and accounts nobody watches.

Require MFA everywhere, and prefer phishing-resistant MFA

A sprayed password is useless if a second factor is required. Both the Midnight Blizzard case and AA24-057A involved accounts without MFA, and AA24-290A recommends phishing-resistant MFA because push-based MFA can be defeated by push bombing. Our explainer on how passkeys work covers the strongest option. Make sure test tenants, break-glass procedures and service accounts are either covered or compensated for.

Block legacy authentication

Because legacy protocols cannot do MFA, a password alone is enough on those paths. Block legacy authentication with Conditional Access, or with security defaults if you do not have Conditional Access licenses, after checking the Client App column in sign-in logs to find who still depends on it.

Ban the passwords sprayers try

NIST SP 800-63B-4, the July 2025 revision of the US federal Digital Identity Guidelines for authentication, requires verifiers to compare new passwords against a blocklist of commonly used, expected or compromised values. It also requires a minimum of 15 characters for passwords used as a single factor (eight when the password is only part of MFA), prohibits composition rules such as mandatory symbols, and prohibits forced periodic password changes unless there is evidence of compromise. Those rules work against sprays, because complexity rules and forced rotation tend to produce predictable patterns such as a season plus a year.

In Microsoft environments, Entra Password Protection applies a global banned password list built from Microsoft's spray telemetry to every tenant, normalizes common character substitutions, and lets you add up to 1,000 organization-specific terms such as company, product and location names. Deploy the on-premises agent so the same check applies to Active Directory password changes.

Tune lockout and rate limiting together

NIST SP 800-63B-4 requires verifiers to limit consecutive failed attempts on an account to no more than 100 and suggests rate limiting, increasing wait times and risk-based checks on IP address, geolocation and timing. In hybrid environments, Microsoft recommends setting the Entra smart lockout threshold lower than the Active Directory lockout threshold, with Active Directory at least two to three times higher, and the Entra lockout duration longer, so the cloud blocks sprays before they lock out on-premises accounts. Lockout limits the damage of a spray; it does not detect one.

Clean up service, test and dormant accounts

Inventory accounts that cannot use MFA. Replace service account passwords with managed identities or certificate-based authentication where possible, restrict where they can sign in from, give them long random passwords, and disable dormant and test accounts, as AA24-057A recommends.

Which control closes which gap

How to Test Your Exposure Safely

Testing for password spraying exposure is legitimate and useful, but it is also a live attack technique against real users, so it must only happen with written authorization and agreed rules of engagement. This section stays at the level of what to measure. It does not cover tools, commands or password lists.

Start with checks that need no spraying at all

1. MFA coverage. List every account, including service, test and break-glass accounts, that can sign in with a password alone.
2. Legacy authentication use. Check sign-in logs for successful legacy protocol sign-ins.
3. Password policy against NIST SP 800-63B-4. Confirm blocklist checks, minimum length, and no forced rotation or composition rules.
4. Lockout settings. Compare Entra smart lockout and Active Directory thresholds against Microsoft's hybrid guidance.
5. Detection coverage. Confirm Entra sign-in logs, domain controller 4771 events and host 4625 events reach your SIEM, and that a cross-account rule exists.

When a live test is justified

An authorized external or red team engagement can measure what the configuration review cannot: whether a real spray against your sign-in pages would find a weak password and whether the SOC would notice. Good rules of engagement for any password-guessing test include:

• Written authorization from the account owner organization, with the sign-in endpoints in scope named explicitly.
• An agreed, small set of candidate passwords and a maximum number of attempts per account per time window, set well below lockout thresholds.
• Agreed test windows, source IP addresses and a stop condition, such as any unexpected lockout or business impact.
• A decision on whether the SOC is told in advance (for a control test) or not (for a detection test), with a named contact who can halt the test.
• Handling rules for any valid credential found: report it immediately, do not use it beyond what the scope allows, and require a reset.

Our external penetration testing guide explains how internet-facing sign-in services are scoped, our red teaming explainer covers objective-based tests that measure detection, and purple teaming is the fastest way to tune the cross-account detection rules described above with the attacker and defender in the same room.

When you choose a provider, ask how they control lockout risk, whether they record which detections fired and how quickly, whether findings map to ATT&CK T1110.003 and follow-on techniques, and how retesting confirms the fixes.

Frequently Asked Questions

What is the difference between password spraying and brute force?

Classic brute force tries many passwords against one account. Password spraying tries one or a few common passwords against many accounts. Spraying is still a brute force technique, which is why MITRE ATT&CK lists it as sub-technique T1110.003 under Brute Force, but it is built to stay under per-account lockout thresholds.

What is the difference between password spraying and credential stuffing?

Credential stuffing uses real username and password pairs leaked from other breaches and tries each pair once, relying on password reuse. Password spraying guesses common passwords without knowing them in advance, relying on weak password choices.

Does MFA stop password spraying?

MFA stops a sprayed password from being enough to sign in, which removes most of the risk. It does not stop the spray itself, and push-based MFA can be abused by push bombing, as CISA AA24-290A describes. Phishing-resistant MFA and blocking legacy protocols that cannot do MFA close those gaps.

Which Windows event IDs show password spraying?

Event 4625 (an account failed to log on) on the machine where the attempt was made, and event 4771 (Kerberos pre-authentication failed, failure code 0x18 for a wrong password) on domain controllers. Look for many accounts failing from one source rather than many failures on one account.

How does Microsoft Entra smart lockout help against password spraying?

Smart lockout locks an account after 10 failed attempts by default in Azure public cloud tenants, separates familiar and unfamiliar locations, and blocks sign-ins it identifies as malicious. It limits damage, but a spray that stays below the threshold on every account still needs cross-account detection.

What passwords do password sprayers use?

They use a short list of passwords many people choose: common base words, seasons and years, and variations on the organization's name or location. That is why banned-password lists that block those base words, as NIST SP 800-63B-4 requires, are one of the most effective defenses.

Next Step: Test Your Identity Defenses Before Attackers Do

Password spraying succeeds through ordinary gaps: one account without MFA, one legacy protocol left open, one weak password, and detection rules that only look at one account at a time. Start with the five checks in this guide, then verify the result from an attacker's point of view.

DeepStrike's red teaming services run objective-driven engagements that include identity abuse scenarios across SSO, VPN, MFA workflows and privilege boundaries, and measure whether your SOC and alerting detect realistic tradecraft. Reports include an executive summary, evidence-backed technical details and prioritized remediation.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• MITRE ATT&CK: Brute Force: Password Spraying, T1110.003
• MITRE ATT&CK: Brute Force, T1110
• MITRE ATT&CK: Valid Accounts: Cloud Accounts, T1078.004
• MITRE ATT&CK: Account Use Policies, M1036
• MITRE ATT&CK: Multi-factor Authentication, M1032
• MITRE ATT&CK: Password Policies, M1027
• Microsoft Security Response Center: Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard (January 19, 2024)
• Microsoft Threat Intelligence: Midnight Blizzard: Guidance for responders on nation-state attack (January 25, 2024)
• Microsoft Threat Intelligence: Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network (October 31, 2024)
• Microsoft Threat Intelligence: Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets (September 14, 2023)
• CISA AA24-290A: Iranian Cyber Actors' Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations (October 16, 2024)
• CISA AA24-057A: SVR Cyber Actors Adapt Tactics for Initial Cloud Access (February 26, 2024)
• Microsoft Learn: Prevent attacks using smart lockout
• Microsoft Learn: Password protection in Microsoft Entra ID
• Microsoft Learn: Block legacy authentication with Conditional Access
• Microsoft Learn: What are risk detections? (Microsoft Entra ID Protection)
• Microsoft Learn: Microsoft Entra authentication and authorization error codes
• Microsoft Learn: Event 4625, an account failed to log on
• Microsoft Learn: Event 4771, Kerberos pre-authentication failed
• NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management (July 2025)
• NIST SP 800-63B-4 (HTML edition)