Log in Request a demo

Glossary

Password Spraying.

Also called password spray, low and slow password attack

In Short

Password spraying is a brute force technique where an attacker tries one password, or a small list of common passwords, against many accounts. MITRE says this helps avoid the account lockouts that come from many guesses against one account. It is often aimed at login services.

Last updated October 9, 2026
Profile MapGlossary Term
  1. Also Called2other namespassword spray · low and slow password attack
  2. Related Terms3linked entriesBrute force attack · Account takeover

What is password spraying?

MITRE describes password spraying as using a single password, or a small list of commonly used passwords, against many accounts. It is one of four sub-techniques MITRE lists under brute force. The others are password guessing, password cracking and credential stuffing.

How does password spraying work?

Many systems lock an account after a number of failed logins. MITRE says spraying tries to stay under that limit by testing one password across a large set of accounts instead of many passwords against one. MITRE lists commonly targeted services and ports, such as SSH, Telnet, FTP, SMB, LDAP, Kerberos, RDP, HTTP and HTTPS, and database services. It also says attackers may deliberately throttle their attempts to avoid triggering alerts, and may use LDAP or Kerberos because these are less likely to trigger high-visibility events.

A simple illustration: an attacker has a list of staff usernames and tries one common password on every one of them. Any account that uses that password is exposed.

Why does it matter?

Spraying needs no stolen data about a person, only a list of accounts and a few common passwords. Because each account sees very few failed attempts, a lockout rule alone may not catch it. A single weak password on one account can be enough to give an attacker a first foothold.

How can you detect and reduce it?

MITRE lists these mitigations:

  • Set account lockout thresholds and use conditional access policies that block risky sign-in requests.
  • Use multi-factor authentication on externally facing services.
  • Follow NIST guidelines when setting password policies.

For detection, MITRE points to a high volume of authentication failures using a single password across many different user accounts within a defined time window. It also suggests watching for repeated failures with the same credentials across single sign-on applications or mailboxes. Watching across accounts, not only per account, is the key idea.

Is password spraying the same as brute force?

It is a form of brute force. MITRE defines brute force as systematically guessing a password with a repetitive or iterative mechanism. Spraying is the version that spreads a few guesses across many accounts.

Is password spraying the same as credential stuffing?

No. MITRE lists them as separate sub-techniques. Spraying guesses common passwords. Credential stuffing tests previously compromised credentials.

See also brute force attack, multi-factor authentication and account takeover.

Sources

  • MITRE ATT&CK: MITRE defines password spraying, notes targeted services, evasion by throttling, mitigations (lockout, MFA, NIST password policy) and detection analytics.
  • MITRE ATT&CK: MITRE defines brute force and lists password spraying and credential stuffing as separate sub-techniques.

Also Called.

  • Namepassword spray
  • Namelow and slow password attack

Questions.

  • What is password spraying?

    MITRE describes password spraying as using a single password, or a small list of commonly used passwords, against many accounts. It is one of four sub-techniques MITRE lists under brute force.

  • How does password spraying avoid account lockouts?

    Many systems lock an account after several failed logins. MITRE says spraying stays under that limit by testing one password across a large set of accounts instead of many passwords against one. Attackers may also throttle attempts to avoid alerts.

  • How do I defend against password spraying?

    MITRE lists these mitigations: set account lockout thresholds and use conditional access policies that block risky sign-ins, use multi-factor authentication on externally facing services, and follow NIST guidelines for password policies.

  • Is password spraying the same as credential stuffing?

    No. MITRE lists them as separate sub-techniques. Spraying guesses common passwords across many accounts, while credential stuffing tests previously compromised credentials. Both sit under brute force, which MITRE defines as systematically guessing a password.

In Our Research

  1. 1 Password Spraying Attacks: Complete Guide to Detection & Prevention June 2025
  2. 2 GRU targeting of logistics firms: advisory AA25-141A October 2026
  3. 3 APT33/Peach Sandstorm: Threat Forecast and Analysis of a Cloud-Focused Adversary November 2025
  4. 4 HAFNIUM Threat group

Keep Exploring.

Knowledge Hub
Threat group HAFNIUM Attributed by the US and UK governments (19 July 2021) to the Chinese state, and charged by the US Department of Justice (8 July 2025) as directed by officers of China's Ministry of State Security, HAFNIUM is the name given to the campaign that exploited Microsoft Exchange Server flaws in early 2021. MITRE describes it as a likely state-sponsored espionage group that targets US universities, law firms, defense contractors and research bodies. Open Article What Is Credential Stuffing? Attackers Don’t Crack Passwords, They Buy Them Credential stuffing explained: how attackers test real stolen username and password pairs across services, where the lists come from, and how to detect it. Open Glossary term Leaked Credentials Leaked credentials are usernames, passwords or other login details that have become exposed outside the control of their owner. Open

Browse The Library.