Cross-source coverage

T1110.003 / ATT&CK

Brute Force: Password Spraying

79 rules across 5 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following:

  • SSH (22/TCP)
  • Telnet (23/TCP)
  • FTP (21/TCP)
  • NetBIOS / SMB / Samba (139/TCP & 445/TCP)
  • LDAP (389/TCP)
  • Kerberos (88/TCP)
  • RDP / Terminal Services (3389/TCP)
  • HTTP/HTTP Management Services (80/TCP & 443/TCP)
  • MSSQL (1433/TCP)
  • Oracle (1521/TCP)
  • MySQL (3306/TCP)
  • VNC (5900/TCP)

In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.

In order to avoid detection thresholds, adversaries may deliberately throttle password spraying attempts to avoid triggering security alerting. Additionally, adversaries may leverage LDAP and Kerberos authentication attempts, which are less likely to trigger high-visibility events such as Windows "logon failure" event ID 4625 that is commonly triggered by failed SMB connection attempts.

Platforms
Containers · ESXi · IaaS · Identity Provider · Linux · Network Devices · Office Suite · SaaS · Windows · macOS
Telemetry
WinEventLog:Securitylinux:syslogmacos:unifiedlogazure:signinlogsnetworkdevice:syslogkubernetes:auditm365:exchangesaas:auth

How MITRE says to detect it DET0487

Distributed Password Spraying via Authentication Failures Across Multiple Accounts

Windows Analytic 1336

A high volume of authentication failures using a single password (or small set) across many different user accounts within a defined time window

  • WinEventLog:Security EventCode=4625, 4771, 4648

Linux Analytic 1337

Authentication failures across different accounts using a repeated or similar password via SSH or PAM stack within a short window

  • linux:syslog Failed password for invalid user

macOS Analytic 1338

Multiple failed login attempts across different users using common password patterns (e.g., 'Welcome2023')

  • macos:unifiedlog Login Window and Authd errors

Identity Provider Analytic 1339

Sign-in failures across enterprise SSO applications or SaaS platforms from same IP address using the same password against multiple user identities

  • azure:signinlogs Failure Reason + UserPrincipalName

Network Devices Analytic 1340

Authentication failure logs on routers/switches showing repeated use of default or common passwords across multiple accounts

  • networkdevice:syslog AAA or TACACS authentication failures

Containers Analytic 1341

Repeated failed authentication attempts to container APIs, control planes, or login shells across many user names using same password

  • kubernetes:audit Failed login

Office Suite Analytic 1342

Failed authentication attempts across user mailboxes using identical or common passwords (e.g., OWA brute attempts)

  • m365:exchange FailedLogin

SaaS Analytic 1343

SaaS applications receiving authentication failures for dozens of accounts using same password or login signature

  • saas:auth signin_failed

View on attack.mitre.org ↗

splunk/security_content

40 rules
Detection Severity Format
AWS High Number Of Failed Authentications From Ip Undefined SPL
AWS Multiple Users Failing To Authenticate From Ip Undefined SPL
AWS Unusual Number of Failed Authentications From Ip Undefined SPL
Azure Active Directory High Risk Sign-in Undefined SPL
Azure AD High Number Of Failed Authentications From Ip Undefined SPL
Azure AD Multiple Users Failing To Authenticate From Ip Undefined SPL
Azure AD Multi-Source Failed Authentications Spike Undefined SPL
Azure AD Successful Authentication From Different Ips Undefined SPL
Azure AD Unusual Number of Failed Authentications From Ip Undefined SPL
Cisco ASA - User Account Lockout Threshold Exceeded Undefined SPL

+ 30 more from splunk/security_content → showing the 10 highest-severity

elastic/detection-rules

31 rules
Detection Severity Format
Entra ID Excessive Account Lockouts Detected High Elastic TOML
Entra ID Protection - Risk Detection - Sign-in Risk High Elastic TOML
Entra ID Protection - Risk Detection - User Risk High Elastic TOML
Entra ID Sign-in TeamFiltration User-Agent Detected High Elastic TOML
Multiple SonicWall Login Failures Followed by Successful Login High Elastic TOML
Okta Successful Login After Credential Attack High Elastic TOML
Potential SSH Brute Force Detected on Privileged Account High Elastic TOML
Potential Successful SSH Brute Force Attack High Elastic TOML
Attempts to Brute Force an Okta User Account Medium Elastic TOML
Deprecated - Potential Successful Linux FTP Brute Force Attack Detected Medium Elastic TOML

+ 21 more from elastic/detection-rules → showing the 10 highest-severity

Azure/Azure-Sentinel

3 rules
Detection Severity Format
Low & slow password attempts with volatile IP addresses Undefined KQL
Privileged identities authenticating via legacy protocols Undefined KQL
Short-window IP failure burst followed by successful sign-in Undefined KQL

panther-labs/panther-analysis

3 rules
Detection Severity Format
Azure Excessive Account Lockouts High Panther Python
OpenAI Brute Force Login Success High Panther Python
Snowflake Password Spray Medium Panther Python

chronicle/detection-rules

2 rules
Detection Severity Format
okta_threatinsight_suspected_password_spray_attack Medium YARA-L
rw_windows_password_spray_T1110_003 Medium YARA-L

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.