Password Spraying: The Attack Account Lockout Was Never Going to Stop

Password spraying tries a small number of likely passwords against a large number of accounts. It is the inverse of brute force, and the inversion is deliberate: by keeping attempts per account below any lockout threshold, it makes the standard defence irrelevant.

How it evades the usual controls

A lockout policy triggers after some number of failures on one account. An attacker trying two passwords against five thousand accounts generates ten thousand failures and never approaches the threshold on any of them.

Timing spreads it further. Attempts are paced across hours or days, and the second password is tried only after the lockout counter window has reset. Distributing the source across a residential proxy pool removes the per-address signal as well.

The result is an attack that produces a great deal of noise in aggregate and none at all at the level most alerting operates on. Recognizing that lockout does not defend against this — and does not defend against credential stuffing either — is the core exam point.

Where the passwords come from

Not random. Attackers use what works: seasonal patterns combining a season and the current year, the organization's own name with a number, common words with predictable substitutions, and default passwords set during onboarding that were never changed.

The seasonal pattern is effective precisely because of expiration policies. An organization forcing a change every ninety days trains users to increment a predictable suffix, which is one of the reasons forced rotation is now discouraged — the reasoning under password policy.

Usernames come from the organization's published email format applied to names harvested from public profiles, which is the aggregation problem described under reconnaissance against a public site. Building a list of several thousand valid usernames for a mid-sized organization is an afternoon's work.

Legacy authentication is the usual entry point

The detail that matters most in practice. Modern authentication endpoints enforce multi-factor authentication and conditional access policy; legacy protocols predate both and frequently cannot enforce either.

Older mail and directory protocols, basic authentication endpoints, and API paths that were never brought under the modern policy all accept a username and password and return success. An attacker who sprays the legacy endpoint bypasses every control applied to the main one, and the successful login then works everywhere.

Disabling legacy authentication is consequently the single highest-value change available against this attack, and it is the one organizations defer because something old still depends on it. Finding out what does — by auditing which protocols are actually in use — is the prerequisite, and the list is usually shorter than feared.

Detecting it

The signal exists only in aggregate, so the detections have to be written that way.

Many distinct usernames attempted from one source in a window, which catches the unsophisticated version. One username attempted from many sources, which catches the distributed version from the other direction.

A rise in the overall ratio of failed to successful authentications across the tenant or service, independent of any single account or address. This is the detection that survives pacing and distribution, because the attacker cannot avoid generating failures somewhere.

Failures against accounts that do not exist, which indicates enumeration from a generated list rather than legitimate users mistyping.

A success following a pattern of failures — the alert that actually matters, and the one missing from most deployments, which count failures and stop there.

Feed authentication logs from every endpoint including the legacy ones into your SIEM, and alert on the ratio rather than on thresholds. Geographic and device anomalies on a successful login catch the compromise after the fact, using the impossible travel reasoning.

Preventing it

Multi-factor authentication makes a correct password insufficient, and phishing-resistant methods such as FIDO2 and passkeys close the relay variants too. This is the control that ends the attack rather than detecting it.

Breached and common password screening at the point a password is set removes the ammunition directly — if the passwords attackers try cannot be chosen, spraying finds nothing.

Smart lockout that distinguishes familiar from unfamiliar sources avoids the denial-of-service problem of conventional lockout while still slowing attempts from unknown locations.

Disable legacy authentication, and apply conditional access so that risky sign-ins face additional requirements.

Note that conventional account lockout remains worth having against single-account brute force; it simply is not the answer here, and treating it as one is the misconception the exam tests.

Exam angles

Define password spraying as few passwords against many accounts, contrasted with brute force (many passwords, one account) and credential stuffing (known valid pairs). Know that it is designed to stay below lockout thresholds, so lockout does not defend against it. Identify legacy authentication endpoints that cannot enforce MFA as the common entry point, and name MFA, breached password screening, smart lockout and aggregate failure-ratio detection as the controls.