Password spraying is a brute force technique where an attacker tries one password, or a small list of common passwords, against many accounts. MITRE says this helps avoid the account lockouts that come from many guesses against one account. It is often aimed at login services.
- Also Called2other namespassword spray · low and slow password attack
- Related Terms3linked entriesBrute force attack · Account takeover
What Is Password Spraying?
MITRE describes password spraying as using a single password, or a small list of commonly used passwords, against many accounts. It is one of four sub-techniques MITRE lists under brute force. The others are password guessing, password cracking and credential stuffing.
How Does Password Spraying Work?
Many systems lock an account after a number of failed logins. MITRE says spraying tries to stay under that limit by testing one password across a large set of accounts instead of many passwords against one.
How Does One Spray Round Run, Step by Step?
MITRE describes the pattern in these stages. Each account sees only a few failures, which is why the pattern is hard to spot account by account.
- Pick the target serviceManagement services on common ports such as SSH, RDP, SMB and LDAP, or SSO and email apps.Technique T1110.003 (MITRE ATT&CK, opens in a new tab)
- Pick a common passwordOne password, or a short list, that may meet the domain complexity policy, such as Password01.Technique T1110.003 (MITRE ATT&CK, opens in a new tab)
- Try it on every accountThe same password goes against many accounts, so no single account reaches the lockout limit.
- Slow downAttempts may be throttled. LDAP and Kerberos are less likely to raise event 4625.
- Use the hitAn account that accepts the password becomes a valid account for the attacker.Technique T1078 (MITRE ATT&CK, opens in a new tab)
Why Does a Lockout Rule Miss It?
Spraying needs no stolen data about a person, only a list of accounts and a few common passwords. Because each account sees very few failed attempts, a lockout rule alone may not catch it. A single weak password on one account can be enough to give an attacker a first foothold.
What Does a Spray Look Like in the Logs?
MITRE lists these mitigations:
- Set account lockout thresholds and use conditional access policies that block risky sign-in requests.
- Use multi-factor authentication on externally facing services.
- Follow NIST guidelines when setting password policies.
For detection, MITRE points to a high volume of authentication failures using a single password across many different user accounts within a defined time window. It also suggests watching for repeated failures with the same credentials across single sign-on applications or mailboxes. Watching across accounts, not only per account, is the key idea. Our password spraying detection guide goes deeper.
Is Password Spraying the Same as Brute Force?
It is a form of brute force. MITRE defines brute force as systematically guessing a password with a repetitive or iterative mechanism. Spraying is the version that spreads a few guesses across many accounts.
Is Password Spraying the Same as Credential Stuffing?
No. MITRE lists them as separate sub-techniques. Spraying guesses common passwords. Credential stuffing tests previously compromised credentials, as explained in our credential stuffing guide.
Related Pages in the Knowledge Hub
- Brute force attack
- Multi-factor authentication
- Account takeover
- Valid Accounts
- Remote Services
- External Remote Services
- Leaked credential monitoring
Sources
- MITRE ATT&CK: MITRE defines password spraying, notes targeted services, evasion by throttling, mitigations (lockout, MFA, NIST password policy) and detection analytics.
- MITRE ATT&CK: Valid Accounts (T1078), the access a successful spray gives.
- MITRE ATT&CK: MITRE defines brute force and lists password spraying and credential stuffing as separate sub-techniques.
Also Called.
- Namepassword spray
- Namelow and slow password attack
Questions.
-
What is password spraying?
MITRE describes password spraying as using a single password, or a small list of commonly used passwords, against many accounts. It is one of four sub-techniques MITRE lists under brute force.
-
How does password spraying avoid account lockouts?
Many systems lock an account after several failed logins. MITRE says spraying stays under that limit by testing one password across a large set of accounts instead of many passwords against one. Attackers may also throttle attempts to avoid alerts.
-
How do I defend against password spraying?
MITRE lists these mitigations: set account lockout thresholds and use conditional access policies that block risky sign-ins, use multi-factor authentication on externally facing services, and follow NIST guidelines for password policies.
-
Is password spraying the same as credential stuffing?
No. MITRE lists them as separate sub-techniques. Spraying guesses common passwords across many accounts, while credential stuffing tests previously compromised credentials. Both sit under brute force, which MITRE defines as systematically guessing a password.
In Our Research
- 1 Password Spraying Attacks: Complete Guide to Detection & Prevention June 2025
- 2 Storm-0940 Used ARTEX Against ConnectWise: What Microsoft 365 Admins Should Check October 2026
- 3 GRU targeting of logistics firms: advisory AA25-141A October 2026
- 4 APT33/Peach Sandstorm: Threat Forecast and Analysis of a Cloud-Focused Adversary November 2025
- 5 APT29 (Cozy Bear): Aliases, Attacks and Defenses September 2025
- 6 HAFNIUM Threat group