Password Spraying

Glossary

What Is Password Spraying? Password spraying is an authentication attack where an attacker tries a small number of commonly used passwords against a large number of accounts. Unlike brute force, which targets one account with many password attempts, a password spray attack distributes attempts across many accounts to avoid triggering lockout mechanisms. This technique exploits a fundamental weakness in how organizations enforce password policies. When thousands of users share the same password requirements, a predictable percentage will choose identical or near-identical passwords. Attackers only need one match to gain access. The password spraying vs. [brute force](/glossary/brute-force-attack) distinction is critical as spraying trades volume per account for breadth across accounts, which is why it often succeeds where brute force fails. ## Key Takeaways - Password spraying tries a few common passwords against many accounts instead of many passwords against one account. - The attack deliberately stays below account lockout thresholds, making it difficult to detect with standard authentication monitoring. - Enterprise environments with thousands of accounts and uniform password policies are the primary targets. - Password spray detection requires monitoring for distributed low-rate login failures across many accounts simultaneously. - MFA is the most effective single control, but defense requires layered detection and password policy improvements. ## The Mechanics Behind a Password Spray Campaign A typical spray campaign follows a deliberate sequence. The attacker first enumerates valid usernames through directory harvesting, email scraping, LinkedIn collection, or LDAP queries against exposed services. With a list of valid accounts in hand, they select a small set of passwords, often just two or three, drawn from publicly available lists of the most commonly used passwords. The attacker then submits one password across all accounts, waits a period (often 30 to 60 minutes) to avoid time-based lockout triggers, and then tries the next password. Each account receives only one or two attempts per cycle. This pace avoids lockout policies that typically trigger after five to ten consecutive failures. Automation tools handle the timing and distribution. The attacker monitors for successful authentications and pivots to the compromised account within minutes of gaining access. ## Why Password Spraying Is So Effective Against Enterprise Environments Large organizations present ideal conditions for password spray attacks. Several factors compound the risk. Enterprise directories contain thousands of accounts, which gives the attacker a statistically significant target pool. Even if only 0.5% of users choose "Summer2024!" as their password, that yields dozens of compromised accounts in a 10,000-user organization. Uniform password policies create predictable patterns. When the policy requires eight characters, one uppercase letter, one number, and one symbol, users converge on the same structures. Password rotation requirements make this worse: users append incrementing numbers or swap seasons, creating patterns attackers can predict. [Service accounts](/glossary/service-account-security) and shared mailboxes are particularly vulnerable. These accounts often use static passwords, lack MFA, and are monitored less frequently than individual user accounts. An account takeover attack against a service account can provide persistent access that survives individual user password resets. ## How to Detect Password Spraying Before Accounts Are Compromised Standard per-account lockout monitoring will not catch a spray campaign because no single account receives enough failed attempts to trigger an alert. Effective password spray detection requires a different analytical approach. This includes: - Cross-account correlation: Monitor for a single password hash or authentication pattern appearing in failed login attempts across many accounts within a short time window. - Baseline deviation: Track the normal ratio of failed to successful authentications across the directory. A spray campaign shifts this ratio measurably even when individual account failure counts stay low. - Source analysis: Flag authentication attempts originating from IP addresses, ASNs, or geographic regions with no history of legitimate access for any account in the directory. - Protocol-level signals: Spray attacks frequently target legacy protocols like IMAP, POP3, or SMTP that may not enforce MFA, making protocol-specific monitoring essential. Teams focused on detecting and preventing [application security vulnerabilities](/glossary/application-security-vulnerability) should extend their monitoring to include these authentication-layer patterns. ## Prevention Controls That Make Password Spraying Significantly Harder to Execute Reducing exposure to spray attacks requires controls that address both the attacker's enumeration phase and the authentication weakness itself. Some of these controls include: - Multi-factor authentication: MFA is the single most effective defense. Even if an attacker guesses a correct password, they cannot complete authentication without the second factor. - Banned password lists: Block the most commonly used passwords at creation time. Azure AD and similar identity platforms support custom banned password lists that reject weak choices. - Smart lockout: Use intelligent lockout that distinguishes between the legitimate user and an attacker, locking out suspicious IP sources rather than the account itself. - Disable legacy protocols: Shut down authentication pathways like IMAP and SMTP-AUTH that bypass MFA and provide spray attackers with unprotected entry points. - Credential hygiene: Teams that manage [secrets in code](/glossary/hardcoded-credentials) and service account credentials should enforce the same password complexity and rotation standards applied to individual users. ## FAQs ### Why does password spraying avoid account lockouts when brute force attacks trigger them? Password spraying limits attempts to one or two passwords per account per cycle, staying below the lockout threshold that typically triggers after five to ten consecutive failures. By spreading attempts across many accounts and adding delays between cycles, the attack avoids the per-account volume that lockout policies detect. ### What is the most common list of passwords used in password spraying campaigns? Attackers use publicly available lists compiled from previous data breaches and password studies. The top candidates typically include seasonal patterns ("Winter2024!"), company-related terms, and perennial favorites like "Password1!" and "Welcome1!". Lists are customized per target using the organization's name, location, and password policy requirements. ### How do attackers identify valid usernames before launching a password spray? Common methods include scraping LinkedIn profiles for employee email formats, harvesting addresses from public data breaches, querying exposed LDAP directories, and testing email addresses against login pages that return different error messages for valid versus invalid usernames. Some organizations expose directory information through misconfigured Office 365 or Azure AD endpoints. ### Can MFA prevent password spraying attacks entirely? MFA prevents attackers from completing authentication even with a correct password, making it the strongest single defense. However, MFA is not absolute. Phishing-resistant MFA (FIDO2, hardware keys) is significantly more effective than SMS or push-based MFA, which attackers can bypass through social engineering or MFA fatigue attacks.