Password Spraying: What It Is and How to Detect the Attack

Most systems lock an account after five or ten wrong passwords. So the attacker does the opposite of what you'd expect: instead of trying a thousand passwords on one account, they try one password ("Summer2026!", "Company@123") on a thousand accounts, and only return to the first one after a pause. Each account sees a single failed attempt and no lockout fires. That is password spraying.

What is password spraying

What is password spraying and how is it different from brute force?

Password spraying is an attack that tests a few common passwords against many accounts, instead of many passwords against one. Since each account gets very few attempts, lockout-by-failure-count never triggers.

The logic is statistical: in a company with thousands of users, someone always has a predictable password: the company name, the season, "Change123". The attacker collects a list of emails (often just guessing the [email protected] pattern), picks one or two passwords and runs. If one in a thousand hits, they have a foothold. MITRE ATT&CK catalogs the technique as T1110.003.

Don't confuse it with credential stuffing: there the attacker uses real email/password pairs leaked in other incidents. Spraying involves no leak at all; it bets on the weak password.

A real case: Microsoft and Midnight Blizzard

In January 2024 Microsoft disclosed, on the MSRC blog, that the Russian group Midnight Blizzard got into its corporate network through a password spraying attack against an old test account on a legacy, non-production tenant. According to Microsoft itself, that account had no MFA. From it, the group reached a small percentage of corporate mailboxes, including those of senior leadership and the security and legal teams. The company detected the intrusion on January 12, 2024; it says it began in late November 2023. Bleeping Computer covered the case at the time.

The lesson isn't "Microsoft messed up." It's that the forgotten account without MFA is exactly what spraying looks for, and almost every organization has one.

Why it goes unnoticed

• Low volume per account: one or two attempts per user look like a typo.
• Long intervals: the attacker waits between rounds to stay under the lockout threshold.
• Distributed IPs: reports on the Midnight Blizzard case mention distributed residential infrastructure, which defeats single-IP rules.
• Legacy protocols: services that can't do MFA (legacy authentication, IMAP, basic SMTP) become the favorite door.

How to detect it in logs

How do I know if my company is under a password spraying attack?

Look for one IP (or range) failing against many different accounts in a short time, rather than many failures on the same account. That "one to many" pattern is the signature of spraying.

Where to look:

• Active Directory: enable credential validation and Kerberos authentication service auditing on domain controllers. Event 4625 records logon failures (NTLM) and 4771 records Kerberos pre-authentication failures. In 4625, sub-status 0xC000006A means wrong password for an existing user; 0xC0000064 means nonexistent user. Lots of the latter point to account enumeration.
• Microsoft Entra ID: the sign-in logs show every attempt. Codes like AADSTS50126 (invalid credentials) spread across many users from the same IP are the alert. An AADSTS50079 (MFA required) right after failures may mean the password was correct.
• Watch for gaps: spraying over LDAP may not generate 4625, so that event alone isn't enough.

# Count of distinct failed accounts per IP (Windows, exported logs)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-1)} |
  ForEach-Object {
    $x = [xml]$_.ToXml()
    [pscustomobject]@{
      IP   = ($x.Event.EventData.Data | Where-Object Name -eq 'IpAddress').'#text'
      User = ($x.Event.EventData.Data | Where-Object Name -eq 'TargetUserName').'#text'
    }
  } | Group-Object IP |
  Select-Object Name, @{n='ContasDistintas';e={($_.Group.User | Sort-Object -Unique).Count}} |
  Sort-Object ContasDistintas -Descending | Select-Object -First 10

The script lists the ten IPs that failed against the most different accounts in the last hour. Dozens of accounts from a single IP is not users forgetting passwords. For more on reading logs, see the guide to Get-WinEvent for investigating Windows events.

How to defend

1. MFA on everything, no exceptions: test accounts, old service accounts and former employees included. Prefer methods resistant to MFA fatigue, such as a TOTP app or passkeys.
2. Block legacy authentication that doesn't support MFA.
3. Banned password list: block passwords like company name + year. Entra ID offers password protection and smart lockout, which tracks failures per credential and not just per IP; check the limits in Microsoft's documentation.
4. Account inventory: disable dormant and test accounts. One of them opened the door in the case above.
5. "One IP, many accounts" alerts in your SIEM or, at minimum, the periodic query above.
6. For personal use: a unique, long password per service, in a password manager. Spraying only works against predictable passwords.

Conclusion

Password spraying doesn't depend on a vulnerability, malware or a leak; it depends on one weak password on one account without MFA. That's why the defense is dull and effective: a second factor on every account, banned passwords and a clean inventory. To stay in the same cluster, read how credential stuffing works and compare the two attacks side by side.