Password spray
noun · also Password spraying · MITRE ATT&CK T1110.003
An attack that tries a few common passwords against many accounts, staying under lockout limits that per-account guessing would trigger.
A classic brute-force attack hammers one account with thousands of passwords and quickly hits account lockout. Password spraying turns this around: the attacker picks one or two likely passwords, such as Spring2026! or the company name followed by a year, and tries them once against hundreds or thousands of accounts. Each account sees only one failure, so lockout never triggers, but in a large organization someone is usually using that password.
Example
Sign-in logs show the same IP address failing to authenticate as 400 different users over 30 minutes, each with error code 50126 (invalid username or password), followed by one success.
Why it matters for a SOC analyst
Spraying is noisy across accounts but quiet per account, so detection means aggregating by source: many distinct users failing from the same IP, ASN or user agent in a short time. A successful sign-in at the end of a spray deserves the same treatment as a confirmed credential compromise, even if MFA stopped the attacker for now.
Articles that use this term
Threat Analysis · · 4 min read
MFA fatigue attacks: how push bombing works and how to stop it
Why attackers flood users with MFA prompts until one gets approved, what the Uber and Cisco breaches teach us, and the controls that make push bombing fail.
Tutorials · · 4 min read
Investigating a suspicious sign-in in Entra ID, step by step
What to check in the sign-in logs, which KQL queries to run, how to compare against the user's normal behavior, and when to revoke sessions and reset access.
Related terms
- Brute force
Gaining access by systematically trying passwords or keys until one works, either online against a login or offline against stolen hashes.
- Credential stuffing
Automated sign-in attempts using username and password pairs leaked from other breaches, betting that people reuse the same password.
- MFA fatigue
An attack that floods a user with MFA push prompts, using a stolen password, until the user approves one out of confusion or annoyance.
- Conditional Access
Microsoft Entra ID's policy engine that decides, at each sign-in, whether to allow access, require MFA or another control, or block.
- SIEM
A platform that collects logs from across an organization, correlates them and raises alerts, giving the SOC one place to investigate.