Password Spraying Attack Detection

What This Means

Detect password spraying attacks across your authentication infrastructure. Learn the patterns that distinguish spraying from brute force and how to protect against this stealthy attack technique.

Example Log

-- Windows Event 4625 pattern showing password spraying:
Event 4625: Account Name: jsmith    Source IP: 203.0.113.50   Time: 14:22:01
Event 4625: Account Name: mwilson   Source IP: 203.0.113.50   Time: 14:22:03
Event 4625: Account Name: klee      Source IP: 203.0.113.50   Time: 14:22:05
Event 4625: Account Name: dgarcia   Source IP: 203.0.113.50   Time: 14:22:07
Event 4625: Account Name: tchen     Source IP: 203.0.113.50   Time: 14:22:09
-- Note: Only 1 attempt per account (avoids lockout threshold)

Indicators of Suspicious Activity

• Single failure per account from the same source IP (stays below lockout threshold)
• Many different accounts failing within a short window from one source
• Failures concentrated on a single common password (e.g., "Spring2026!")
• Attack timing shows regular intervals between attempts (automated tooling)
• Targeted accounts often follow a pattern (all from same department or OU)
• No account lockouts despite widespread authentication failures

How to Investigate

1. Aggregate failed logons by source IP across all accounts over a sliding time window
2. Look for single-failure-per-account patterns (the hallmark of password spraying)
3. Check if any targeted accounts subsequently had a successful logon from the same source
4. Review the targeted account list for patterns (alphabetical, same OU, specific roles)
5. Correlate across authentication protocols — attackers may spray NTLM, Kerberos, and web apps
6. Check Azure AD sign-in logs if hybrid identity is in use

Recommended Mitigations

• Implement smart lockout that tracks failed attempts by IP, not just by account
• Enforce banned password lists to prevent users from choosing commonly sprayed passwords
• Require MFA for all accounts — this defeats password spraying even if credentials are correct
• Deploy Azure AD Password Protection or similar to block common passwords
• Alert on patterns of single failures across many accounts from one IP
• Implement progressive delays between authentication attempts per source IP

Related Log Types

Related Attack Patterns

Frequently Asked Questions