Password spraying

What it means

Password spraying is a guessing attack that turns normal brute force around. Instead of trying thousands of passwords against one account, the attacker tries one or two very common passwords, such as a season and a year, against hundreds or thousands of accounts.

Because each account sees only one or two failed attempts, the usual per-account lockout never triggers. The attacker is counting on the fact that in any large group of people, a few will have picked an easy password. That is why the technique is patient, quiet and low in volume.

Why it matters

It works against the places where an account is already worth having: staff sign-in pages, customer portals and anything exposed to the internet. One success is enough for a foothold, and from there an attacker can read data or try lateral movement. It is catalogued by MITRE as ATT&CK technique T1110.003.

It also exposes how much you rely on account lockout. A control that watches each account alone cannot see a pattern that spans the whole user base. The signal is in the spread: many accounts failing once each, from a small set of sources.

How it shows up

You meet it in sign-in logs as a long run of failures for different usernames, often in an alphabetical list or at a slow, steady pace. Defences are a strong password policy that rejects common passwords, multi-factor sign-in, and rate limits that count across accounts by source, not only per account.

Look at every place that accepts a password, since attackers pick the least guarded one, often an old protocol, a mobile endpoint or a forgotten admin page. Make sure failed sign-ins are logged with account, source and time so that a pattern across accounts can be found.