Password spraying is a brute-force variant that tries a single common password (like Season+Year or Company123) across many accounts, rather than many passwords against one account. By spreading attempts across users and pacing them under the lockout threshold, the attacker finds accounts with weak passwords without locking anyone out. It is a common initial-access and privilege technique against Active Directory. Defend with strong password policy, MFA, and detection tuned for the spray pattern.
What password spraying is
A normal brute force hammers one account with many passwords and trips its lockout. Password spraying inverts that: it tries one password against a whole list of usernames, then waits and tries the next password. Each account sees only a few attempts, so lockouts do not fire, while the attacker still covers a large user base with likely passwords.
How the attack works
The attacker first enumerates valid usernames (from OSINT, or via Kerberos pre-auth with kerbrute userenum), then sprays a common password with a tool such as kerbrute passwordspray users.txt 'Autumn2025!', pacing attempts to stay under the lockout window. One weak password on any account gives a foothold, and if that account is privileged, escalation. Shown for defensive testing.
How to defend against it
Enforce a strong password policy and ban common and breached passwords so the sprayed guesses miss, and require MFA so a guessed password alone is not enough. Tune detection for the spray signature (one password against many accounts, many failed pre-auths or logons in a short window from one source), and use smart lockout that reacts to distributed attempts rather than per-account counts alone.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]MITRE ATT&CK: Password Spraying (T1110.003)(MITRE ATT&CK)
One weak password across your directory is all a spray needs. Talk to a security expert about testing your password and MFA posture.