Password Spraying

T1110.003

Sub-technique of T1110 Brute Force.View on attack.mitre.org

About this technique

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following:

* SSH (22/TCP)
* Telnet (23/TCP)
* FTP (21/TCP)
* NetBIOS / SMB / Samba (139/TCP & 445/TCP)
* LDAP (389/TCP)
* Kerberos (88/TCP)
* RDP / Terminal Services (3389/TCP)
* HTTP/HTTP Management Services (80/TCP & 443/TCP)
* MSSQL (1433/TCP)
* Oracle (1521/TCP)
* MySQL (3306/TCP)
* VNC (5900/TCP)

In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.

In order to avoid detection thresholds, adversaries may deliberately throttle password spraying attempts to avoid triggering security alerting. Additionally, adversaries may leverage LDAP and Kerberos authentication attempts, which are less likely to trigger high-visibility events such as Windows "logon failure" event ID 4625 that is commonly triggered by failed SMB connection attempts.

Detection rules42

Rules on DetectionCode tagged with T1110.003.

Sigma0

No Sigma rules are mapped to this technique yet.

Splunk42

Rule	Type	Risk	Data source
AWS High Number Of Failed Authentications From Ip	Anomaly	NULL	AWS CloudTrail ConsoleLogin
AWS Multiple Users Failing To Authenticate From Ip	Anomaly	NULL	AWS CloudTrail ConsoleLogin
AWS Unusual Number of Failed Authentications From Ip	Anomaly	NULL	AWS CloudTrail ConsoleLogin
Azure Active Directory High Risk Sign-in	TTP	NULL	Azure Active Directory
Azure AD High Number Of Failed Authentications From Ip	TTP	NULL	Azure Active Directory
Azure AD Multi-Source Failed Authentications Spike	Hunting	NULL	Azure Active Directory
Azure AD Multiple Users Failing To Authenticate From Ip	Anomaly	NULL	Azure Active Directory
Azure AD Successful Authentication From Different Ips	TTP	NULL	Azure Active Directory
Azure AD Unusual Number of Failed Authentications From Ip	Anomaly	NULL	Azure Active Directory
Cisco ASA - User Account Lockout Threshold Exceeded	Anomaly	NULL	Cisco ASA Logs
Detect Distributed Password Spray Attempts	Hunting	NULL	Azure Active Directory Sign-in activity
Detect Password Spray Attack Behavior From Source	TTP	NULL	Windows Event Log Security 4624, Windows Event Log Security 4625
Detect Password Spray Attack Behavior On User	TTP	NULL	Windows Event Log Security 4624, Windows Event Log Security 4625
Detect Password Spray Attempts	TTP	NULL	Windows Event Log Security 4625
GCP Multiple Users Failing To Authenticate From Ip	Anomaly	NULL	Google Workspace
GCP Unusual Number of Failed Authentications From Ip	Anomaly	NULL	Google Workspace
Multiple Okta Users With Invalid Credentials From The Same IP	TTP	NULL
O365 Multi-Source Failed Authentications Spike	Hunting	NULL	O365 UserLoginFailed
O365 Multiple Users Failing To Authenticate From Ip	TTP	NULL	O365 UserLoginFailed
Okta Multiple Users Failing To Authenticate From Ip	Anomaly	NULL	Okta
Okta ThreatInsight Suspected PasswordSpray Attack	TTP	NULL
Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos	TTP	NULL	Windows Event Log Security 4768
Windows Multiple Invalid Users Fail To Authenticate Using Kerberos	TTP	NULL	Windows Event Log Security 4768
Windows Multiple Invalid Users Failed To Authenticate Using NTLM	TTP	NULL	Windows Event Log Security 4776
Windows Multiple NTLM Null Domain Authentications	TTP	NULL	NTLM Operational 8004, NTLM Operational 8005, NTLM Operational 8006
Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials	TTP	NULL	Windows Event Log Security 4648
Windows Multiple Users Failed To Authenticate From Host Using NTLM	TTP	NULL	Windows Event Log Security 4776
Windows Multiple Users Failed To Authenticate From Process	TTP	NULL	Windows Event Log Security 4625
Windows Multiple Users Failed To Authenticate Using Kerberos	TTP	NULL	Windows Event Log Security 4771
Windows Multiple Users Remotely Failed To Authenticate From Host	TTP	NULL	Windows Event Log Security 4625
Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos	Anomaly	NULL	Windows Event Log Security 4768
Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos	Anomaly	NULL	Windows Event Log Security 4768
Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM	Anomaly	NULL	Windows Event Log Security 4776
Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials	Anomaly	NULL	Windows Event Log Security 4648
Windows Unusual Count Of Users Failed To Auth Using Kerberos	Anomaly	NULL	Windows Event Log Security 4771
Windows Unusual Count Of Users Failed To Authenticate From Process	Anomaly	NULL	Windows Event Log Security 4625
Windows Unusual Count Of Users Failed To Authenticate Using NTLM	Anomaly	NULL	Windows Event Log Security 4776
Windows Unusual Count Of Users Remotely Failed To Auth From Host	Anomaly	NULL	Windows Event Log Security 4625
Windows Unusual NTLM Authentication Destinations By Source	Anomaly	NULL	NTLM Operational 8004, NTLM Operational 8005, NTLM Operational 8006
Windows Unusual NTLM Authentication Destinations By User	Anomaly	NULL	NTLM Operational 8004, NTLM Operational 8005, NTLM Operational 8006
Windows Unusual NTLM Authentication Users By Destination	Anomaly	NULL	NTLM Operational 8004, NTLM Operational 8005, NTLM Operational 8006
Windows Unusual NTLM Authentication Users By Source	Anomaly	NULL	NTLM Operational 8004, NTLM Operational 8005, NTLM Operational 8006

Groups11

Software4

Bad Rabbit CrackMapExec Linux Rabbit MailSniper

Campaigns2

APT28 Nearest Neighbor Campaign Quad7 Activity

Procedure examples17

Groups11

Used by	Procedure example
GroupAgrius	Agrius engaged in password spraying via SMB in victim environments. Unit42 Agrius 2023
GroupAPT28	APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks. Cybersecurity Advisory GRU Brute Force Campaign July 2021 Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020 Microsoft Targeting Elections September 2020
GroupAPT29	APT29 has conducted brute force password spray attacks. MSRC Nobelium June 2021 MSTIC Nobelium Oct 2021 NCSC et al APT29 2024
GroupAPT33	APT33 has used password spraying to gain access to target systems. FireEye APT33 Guardrail Microsoft Holmium June 2020
GroupChimera	Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts. NCC Group Chimera January 2021
GroupEmber Bear	Ember Bear has conducted password spraying against Outlook Web Access (OWA) infrastructure to identify valid user names and passwords. CISA GRU29155 2024
GroupHAFNIUM	HAFNIUM has gained initial access through password spray attacks. Microsoft Silk Typhoon MAR 2025
GroupHEXANE	HEXANE has used password spraying attacks to obtain valid credentials. SecureWorks August 2019

View all 11 groups examples

Software4

Used by	Procedure example
MalwareBad Rabbit	Bad Rabbit’s `infpub.dat` file uses NTLM login credentials to brute force Windows machines. Secure List Bad Rabbit
ToolCrackMapExec	CrackMapExec can brute force credential authentication by using a supplied list of usernames and a single password. CME Github September 2018
MalwareLinux Rabbit	Linux Rabbit brute forces SSH passwords in order to attempt to gain access and install its malware onto the server. Anomali Linux Rabbit 2018
ToolMailSniper	MailSniper can be used for password spraying against Exchange and Office 365. GitHub MailSniper

Campaigns2

Used by	Procedure example
CampaignAPT28 Nearest Neighbor Campaign	During APT28 Nearest Neighbor Campaign, APT28 performed password-spray attacks against public facing services to validate credentials. Nearest Neighbor Volexity
CampaignQuad7 Activity	Quad7 Activity has conducted a throttled variant of password spraying techniques that only utilized a single attempt to sign in within a 24-hour time period, eluding brute force detection thresholds. Microsoft Storm-0940

References3

BlackHillsInfosec Password Spraying Open source
Thyer, J. (2015, October 30). Password Spraying & Other Fun with RPCCLIENT. Retrieved April 25, 2017.
Microsoft Storm-0940 Open source
Microsoft Threat Intelligence. (2024, October 31). Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert network. Retrieved June 4, 2025.
US-CERT TA18-068A 2018 Open source
US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.