T1110.003sub-technique of T1110 Brute Force
Password Spraying
Containers · ESXi · IaaS · Identity Provider · Linux · Network Devices · Office Suite · SaaS · Windows · macOS4 pieces on this siteT1110.003 on attack.mitre.org
Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Cloud account takeover response plan: sessions, methods, devices and grants, then what they read
A successful sign-in the user did not make, in Microsoft Entra ID and Microsoft 365. A password reset alone evicts almost nobody. The plan works through the order that does, how to tell a guessed password from a stolen session, and how to answer what they read.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: forty failures, no lockouts, one success
A password spray that stayed under the lockout threshold and never produced a failed-logon event on the server it was aimed at. Find where the failures were recorded, identify the account that fell, and explain why the dashboard showed nothing.
Seventeen hours at Calderbrook: from a password spray to data leaving
A constructed intrusion laid out against the clock and the ATT&CK tactics, following the same four stages as the guided labs. Eleven events, one of them inferred, and one tactic conspicuously missing.
Read
Analyses, case studies, guides, references and interview questions.
Entra ID sign-in logs: the fields and error codes that settle an account question
Which fields in a sign-in record separate a traveller from a stolen session, what the common error codes mean, where non-interactive sign-ins hide, and how long any of it is kept.
how MITRE says to see it
Distributed Password Spraying via Authentication Failures Across Multiple Accounts
- A high volume of authentication failures using a single password (or small set) across many different user accounts within a defined time window
- Authentication failures across different accounts using a repeated or similar password via SSH or PAM stack within a short window
- Multiple failed login attempts across different users using common password patterns (e.g., 'Welcome2023')
- Sign-in failures across enterprise SSO applications or SaaS platforms from same IP address using the same password against multiple user identities
what reduces it
- M1027 Password Policies. Refer to NIST guidelines when creating password policies.
- M1032 Multi-factor Authentication. Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services.
- M1036 Account Use Policies. Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out. Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.