| ID | Name |
|---|---|
| T1110.001 | Password Guessing |
| T1110.002 | Password Cracking |
| T1110.003 | Password Spraying |
| T1110.004 | Credential Stuffing |
Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. [1]
Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following:
In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.[2]
In order to avoid detection thresholds, adversaries may deliberately throttle password spraying attempts to avoid triggering security alerting. Additionally, adversaries may leverage LDAP and Kerberos authentication attempts, which are less likely to trigger high-visibility events such as Windows "logon failure" event ID 4625 that is commonly triggered by failed SMB connection attempts.[3]
| ID | Name | Description |
|---|---|---|
| G1030 | Agrius |
Agrius engaged in password spraying via SMB in victim environments.[4] |
| G0007 | APT28 |
APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks.[5][6] APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.[7] |
| C0051 | APT28 Nearest Neighbor Campaign |
During APT28 Nearest Neighbor Campaign, APT28 performed password-spray attacks against public facing services to validate credentials.[8] |
| G0016 | APT29 |
APT29 has conducted brute force password spray attacks.[9][10][11] |
| G0064 | APT33 |
APT33 has used password spraying to gain access to target systems.[12][13] |
| S0606 | Bad Rabbit |
Bad Rabbit’s |
| G0114 | Chimera |
Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.[15] |
| S0488 | CrackMapExec |
CrackMapExec can brute force credential authentication by using a supplied list of usernames and a single password.[16] |
| G1003 | Ember Bear |
Ember Bear has conducted password spraying against Outlook Web Access (OWA) infrastructure to identify valid user names and passwords.[17] |
| G0125 | HAFNIUM |
HAFNIUM has gained initial access through password spray attacks.[18] |
| G1001 | HEXANE |
HEXANE has used password spraying attacks to obtain valid credentials.[19] |
| G0032 | Lazarus Group |
Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.[20][21] |
| G0077 | Leafminer |
Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying.[22] |
| S0362 | Linux Rabbit |
Linux Rabbit brute forces SSH passwords in order to attempt to gain access and install its malware onto the server. [23] |
| S0413 | MailSniper |
MailSniper can be used for password spraying against Exchange and Office 365.[24] |
| C0055 | Quad7 Activity |
Quad7 Activity has conducted a throttled variant of password spraying techniques that only utilized a single attempt to sign in within a 24-hour time period, eluding brute force detection thresholds.[3] |
| G0122 | Silent Librarian |
Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.[25] |
| ID | Mitigation | Description |
|---|---|---|
| M1036 | Account Use Policies |
Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed. Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out. Use conditional access policies to block logins from non-compliant devices or from outside defined organization IP ranges.[26] Consider blocking risky authentication requests, such as those originating from anonymizing services/proxies.[27] |
| M1032 | Multi-factor Authentication |
Use multi-factor authentication. Where possible, also enable multi-factor authentication on externally facing services. |
| M1027 | Password Policies |
Refer to NIST guidelines when creating password policies. [28] |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0487 | Distributed Password Spraying via Authentication Failures Across Multiple Accounts | AN1336 |
A high volume of authentication failures using a single password (or small set) across many different user accounts within a defined time window |
| AN1337 |
Authentication failures across different accounts using a repeated or similar password via SSH or PAM stack within a short window |
||
| AN1338 |
Multiple failed login attempts across different users using common password patterns (e.g., 'Welcome2023') |
||
| AN1339 |
Sign-in failures across enterprise SSO applications or SaaS platforms from same IP address using the same password against multiple user identities |
||
| AN1340 |
Authentication failure logs on routers/switches showing repeated use of default or common passwords across multiple accounts |
||
| AN1341 |
Repeated failed authentication attempts to container APIs, control planes, or login shells across many user names using same password |
||
| AN1342 |
Failed authentication attempts across user mailboxes using identical or common passwords (e.g., OWA brute attempts) |
||
| AN1343 |
SaaS applications receiving authentication failures for dozens of accounts using same password or login signature |