What is password spraying?¶

Password spraying is an authentication attack in which a small number of commonly used passwords are tried across many accounts.

Avoid the dangerous assumption¶

The dangerous assumption is that every repeated login failure is a brute-force attack against one user.

Password spraying works differently.

Instead of testing many passwords against one account, the attacker tests one or a few likely passwords against many accounts. This may reduce the chance of triggering account lockouts.

Evidence may include:

• many failed logins across different usernames
• the same source infrastructure
• similar timestamps
• repeated use of the same password pattern
• successful access to one or more accounts after broad failures
• alerts for distributed or unusual authentication activity.

Investigators should establish whether the account names were valid, whether the attempts were automated and whether any successful login followed.

Do not assume one source IP address means one offender or device. The activity may come through cloud infrastructure, proxies, compromised systems or distributed services.

Also consider legitimate explanations. Misconfigured software, old stored credentials or an organisation-wide service can cause repeated authentication failures across accounts.

The distinction lies in the pattern, context and sequence.

Ask whether the identity platform recorded the targeted usernames, source addresses, user agents, application identifiers, authentication method and result.

Preserve the full time range. A narrow export may hide the broad pattern.

A successful login after password spraying may support the inference that a valid password was found, but it does not identify how the password became valid or who personally controlled the source.

Operational takeaway¶

Look for a broad pattern of low-volume password attempts across many accounts and correlate failures, successes, source infrastructure and legitimate system behaviour.