EXPLORE
← Back to Explore
T1110.003

Password Spraying

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (C...

ContainersESXiIaaSIdentity ProviderLinuxNetwork DevicesOffice SuiteSaaSWindowsmacOS
65
Detections
2
Sources
11
Threat Actors

BY SOURCE

40splunk_escu25elastic

PROCEDURES (26)

Unusual8 detections

Auto-extracted: 8 detections for unusual

Kerbero6 detections

Auto-extracted: 6 detections for kerbero

Brute Force5 detections

Auto-extracted: 5 detections for brute force

Credential5 detections

Auto-extracted: 5 detections for credential

Azure4 detections

Auto-extracted: 4 detections for azure

Privilege4 detections

Auto-extracted: 4 detections for privilege

Bypass3 detections

Auto-extracted: 3 detections for bypass

Authentication Monitoring3 detections

Auto-extracted: 3 detections for authentication monitoring

Aws3 detections

Auto-extracted: 3 detections for aws

Spray3 detections

Auto-extracted: 3 detections for spray

Brute Force3 detections

Auto-extracted: 3 detections for brute force

Anomal2 detections

Auto-extracted: 2 detections for anomal

Cloud2 detections

Auto-extracted: 2 detections for cloud

Service2 detections

Auto-extracted: 2 detections for service

Remote1 detections

Auto-extracted: 1 detections for remote

Azure1 detections

Auto-extracted: 1 detections for azure

Azure1 detections

Auto-extracted: 1 detections for azure

Unusual1 detections

Auto-extracted: 1 detections for unusual

Service1 detections

Auto-extracted: 1 detections for service

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Credential1 detections

Auto-extracted: 1 detections for credential

Spray1 detections

Auto-extracted: 1 detections for spray

Privilege1 detections

Auto-extracted: 1 detections for privilege

Remote1 detections

Auto-extracted: 1 detections for remote

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Lateral1 detections

Auto-extracted: 1 detections for lateral

DETECTIONS (65)

Attempts to Brute Force an Okta User Account
elasticmedium
AWS High Number Of Failed Authentications From Ip
splunk_escu
AWS Multiple Users Failing To Authenticate From Ip
splunk_escu
AWS Unusual Number of Failed Authentications From Ip
splunk_escu
Azure Active Directory High Risk Sign-in
splunk_escu
Azure AD High Number Of Failed Authentications From Ip
splunk_escu
Azure AD Multi-Source Failed Authentications Spike
splunk_escu
Azure AD Multiple Users Failing To Authenticate From Ip
splunk_escu
Azure AD Successful Authentication From Different Ips
splunk_escu
Azure AD Unusual Number of Failed Authentications From Ip
splunk_escu
Cisco ASA - User Account Lockout Threshold Exceeded
splunk_escu
Detect Distributed Password Spray Attempts
splunk_escu
Detect Password Spray Attack Behavior From Source
splunk_escu
Detect Password Spray Attack Behavior On User
splunk_escu
Detect Password Spray Attempts
splunk_escu
Entra ID Excessive Account Lockouts Detected
elastichigh
Entra ID Protection - Risk Detection - Sign-in Risk
elastichigh
Entra ID Protection - Risk Detection - User Risk
elastichigh
Entra ID Sign-in Brute Force Attempted (Microsoft 365)
elasticmedium
Entra ID Sign-in TeamFiltration User-Agent Detected
elasticmedium
Entra ID User Sign-in Brute Force Attempted
elasticmedium
Entra ID User Sign-in with Unusual Authentication Type
elasticmedium
GCP Multiple Users Failing To Authenticate From Ip
splunk_escu
GCP Unusual Number of Failed Authentications From Ip
splunk_escu
M365 Identity User Account Lockouts
elasticmedium
M365 Identity User Brute Force Attempted
elasticmedium
Multiple Logon Failure Followed by Logon Success
elasticmedium
Multiple Logon Failure from the same Source Address
elasticmedium
Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy
elasticmedium
Multiple Okta User Authentication Events with Same Device Token Hash
elasticlow
O365 Multi-Source Failed Authentications Spike
splunk_escu
O365 Multiple Users Failing To Authenticate From Ip
splunk_escu
Okta Multiple Users Failing To Authenticate From Ip
splunk_escu
Okta Successful Login After Credential Attack
elastichigh
Potential External Linux SSH Brute Force Detected
elasticlow
Potential Internal Linux SSH Brute Force Detected
elasticmedium
Potential Okta Password Spray (Multi-Source)
elasticmedium
Potential Okta Password Spray (Single Source)
elasticmedium
Potential Password Spraying Attack via SSH
elasticlow
Potential Successful SSH Brute Force Attack
elastichigh
Privileged Accounts Brute Force
elasticmedium
Spike in Failed Logon Events
elasticlow
Spike in Logon Events
elasticlow
Spike in Successful Logon Events from a Source IP
elasticlow
Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
splunk_escu
Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
splunk_escu
Windows Multiple Invalid Users Failed To Authenticate Using NTLM
splunk_escu
Windows Multiple NTLM Null Domain Authentications
splunk_escu
Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials
splunk_escu
Windows Multiple Users Failed To Authenticate From Host Using NTLM
splunk_escu
Windows Multiple Users Failed To Authenticate From Process
splunk_escu
Windows Multiple Users Failed To Authenticate Using Kerberos
splunk_escu
Windows Multiple Users Remotely Failed To Authenticate From Host
splunk_escu
Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos
splunk_escu
Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos
splunk_escu
Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM
splunk_escu
Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials
splunk_escu
Windows Unusual Count Of Users Failed To Auth Using Kerberos
splunk_escu
Windows Unusual Count Of Users Failed To Authenticate From Process
splunk_escu
Windows Unusual Count Of Users Failed To Authenticate Using NTLM
splunk_escu
Windows Unusual Count Of Users Remotely Failed To Auth From Host
splunk_escu
Windows Unusual NTLM Authentication Destinations By Source
splunk_escu
Windows Unusual NTLM Authentication Destinations By User
splunk_escu
Windows Unusual NTLM Authentication Users By Destination
splunk_escu
Windows Unusual NTLM Authentication Users By Source
splunk_escu