Password Spraying
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
Password spraying is defined by two properties, and neither is present in a single event on any log source the brief offers. The first is 'the same password', and no authentication log on any of the three platforms records the password — Windows 4625 carries TargetUserName, LogonType, IpAddress, WorkstationName, ProcessName, Status and SubStatus and nothing else, 4771 carries the client name, the service and a failure code, 4648 carries the account whose credentials were supplied, and none of them has a credential field at all — so MITRE's PasswordReuseThreshold (AN1336), PasswordReusePattern (AN1337) and CommonPasswordList (AN1338) knobs are not tuning around a detection here, they name data that does not exist in the source. […]
What the technique is
Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. Typically, management services over commonly used ports are used when password spraying. Commonly targeted services include the following: SSH (22/TCP) Telnet (23/TCP) FTP (21/TCP) NetBIOS / SMB / Samba (139/TCP & 445/TCP) LDAP (389/TCP) Kerberos (88/TCP) RDP / Terminal Services (3389/TCP) HTTP/HTTP Management Services (80/TCP & 443/TCP) MSSQL (1433/TCP) Oracle (1521/TCP) MySQL (3306/TCP) VNC (5900/TCP) In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365. In order to avoid detection thresholds, adversaries may deliberately throttle password spraying attempts to avoid triggering security alerting. […]
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1336
A high volume of authentication failures using a single password (or small set) across many different user accounts within a defined time window
- AN1337
Authentication failures across different accounts using a repeated or similar password via SSH or PAM stack within a short window
- AN1338
Multiple failed login attempts across different users using common password patterns (e.g., 'Welcome2023')
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.