Password Spraying

Layer 7: Application High risk

How it works

Instead of trying many passwords against one account, which quickly triggers a lockout, password spraying tries one or two likely passwords against every account it can find. Seasonal patterns, the company name with a number, or simple defaults are common choices. Attackers can often guess usernames from email address formats published on websites or social media. Because each account sees only one or two failures, standard lockout settings are rarely triggered and the activity goes unnoticed.

The attempts are spaced out over time and from many addresses, so they blend into normal background noise. Targets include Microsoft 365, VPN portals, remote desktop gateways and older services that still accept basic password logins. One success is often enough, especially if that account lacks multi-factor authentication or belongs to a forgotten shared or service account. From there, attackers read email, search for more credentials and look for ways to expand their access.

Warning signs

• Failed logins across many users with the same timing
• Sign-in attempts against legacy protocols
• Successful logins to accounts that are rarely used
• Attempts on disabled or former employee accounts
• Authentication from unexpected countries

How to defend against it

• Enforce MFA on every account, including service and shared accounts
• Block commonly used and company-themed passwords
• Disable legacy authentication protocols
• Remove or disable accounts that are no longer needed
• Monitor sign-in logs for spray patterns

If it happens to you

1. Reset passwords for any compromised accounts
2. Enable MFA on accounts that lacked it
3. Investigate what the compromised accounts accessed
4. Block legacy sign-in methods that were targeted