Threat Intelligence

🎯 Password Spraying Attacks: How Enterprise Security Teams Detect and Block Them (2026)

By A Yousif Tanoli · 15 September 2026 · 9 min read · 1,580 words

Russian SVR actors used a single technique — trying one common password against thousands of accounts — to breach networks across NATO governments, and most victims had no alert fire for over two weeks. Password spraying attacks succeed precisely because they stay below standard account-lockout thresholds, and most enterprise environments are still not configured to catch them.

Why Password Spraying Dominates Enterprise Initial Access

Brute force against a single account is noisy and usually blocked within minutes. Password spraying inverts the math: try one password per account, rotate through thousands of accounts, wait a few minutes, repeat with the next password. A standard five-attempt lockout threshold will never fire.

According to CISA Advisory AA23-025A — a joint advisory from the NSA, FBI, and CISA covering Russian SVR (Cozy Bear) tactics — "password spray [was] the primary initial access method used in the campaign that led to multiple government and private sector compromises." The advisory specifically noted that standard lockout policies provided no protection because the attack volume per account never crossed the threshold.

Microsoft's 2024 Digital Defense Report noted that Entra ID blocks approximately 6,000 password-based attacks per second across the Microsoft ecosystem — the vast majority of which are spray-style distributed campaigns. For organizations not running on Entra ID or not using equivalent cloud-based anomaly detection, that volume lands directly in on-premises Active Directory with no automatic protection.

A 2024 Verizon DBIR finding reinforces the stakes: 77% of web application breaches in the dataset involved credential compromise, and of those, most started with an account that was not protected by multi-factor authentication. Password spraying is the tool attackers use to find those accounts.

Spraying vs. Brute Force vs. Credential Stuffing

These three techniques are often confused but carry different detection profiles:

Understanding the distinction matters for detection tuning. A brute-force alert rule fires on high volume per account. A spray alert must fire on distributed low volume — many accounts, few attempts each, potentially from multiple source IPs in a short time window.

How to Detect Password Spraying: SIEM Rules and Event IDs

Detection requires correlating across accounts rather than per-account alerting. Here are the primary signals and how to operationalize them.

On-Premises Active Directory: Windows Event IDs

The core events are logged to the Security event log on domain controllers:

The SIEM rule logic for a spray detection alert looks like this in pseudocode:

ALERT "Password Spray Detected"
WHERE EventID = 4625
  AND LogonType IN (3, 10)        -- Network or RemoteInteractive
  AND Status = 0xC000006A         -- Wrong password (not locked out / no account)
GROUP BY SourceIPAddress, TimeWindow(5 minutes)
HAVING COUNT(DISTINCT TargetUserName) > 20
  AND COUNT(*) / COUNT(DISTINCT TargetUserName) < 3   -- Few attempts per account

Tune the thresholds to your environment. A 20-account threshold over 5 minutes is a starting point; high-volume environments may need 50 accounts over 15 minutes to avoid false positives from misconfigured service accounts.

Microsoft Entra ID (Azure AD): Sign-In Logs

For cloud-connected or hybrid environments, Entra ID provides richer telemetry via the SignInLogs table in Log Analytics:

SignInLogs
| where TimeGenerated > ago(15m)
| where ResultType != 0                         // Failures only
| where ResultDescription contains "Invalid password"
| summarize FailedAccounts = dcount(UserPrincipalName),
            TotalAttempts = count()
  by IPAddress, bin(TimeGenerated, 5m)
| where FailedAccounts > 15
| where TotalAttempts / FailedAccounts < 4      // Spray ratio

Entra ID also has native password protection and Smart Lockout, covered in the blocking section below. Microsoft Sentinel ships a built-in analytics rule called "Password spray attack against Azure AD application" — enable it immediately if you use Sentinel.

Behavioral Indicators Beyond Failed Logins

Spraying campaigns often show secondary signals before authentication failures become obvious:

• LDAP enumeration traffic — attackers often harvest usernames from Active Directory LDAP queries or OWA autocomplete before spraying
• Off-hours authentication attempts — spray campaigns frequently run at 2–5 AM local time to reduce analyst visibility
• Geo-impossible logins — successful authentication from a country with no business presence immediately after a domestic login (Entra ID Risk Detection flags this as Impossible Travel)
• Unfamiliar user-agent strings — scripts calling OWA, Exchange ActiveSync, or legacy SMTP auth endpoints use non-browser user agents

How to Block Password Spraying: Controls That Actually Work

1. Multi-Factor Authentication — The Only Guaranteed Block

MFA is the single control that renders a successful password spray consequence-free. Even if an attacker discovers valid credentials, they cannot complete authentication without the second factor. NCSC guidance states: "Enabling MFA makes it significantly harder for an attacker to take over accounts, even if they have the password."

Priority order for MFA enrollment:

1. All privileged accounts (Domain Admins, Global Admins, Security roles) — enforce via Conditional Access with no exceptions
2. All external-facing services (VPN, OWA, remote desktop gateways, cloud portals)
3. All standard user accounts — target 100% coverage within a defined rollout window

Block legacy authentication protocols (SMTP AUTH, IMAP, POP3, Basic Auth) that cannot enforce MFA. Entra ID Conditional Access can block legacy auth in a single policy. On-premises Exchange requires disabling these protocols per-mailbox and at the connector level.

2. Microsoft Entra Smart Lockout

Unlike traditional AD lockout which locks after N failures from any source, Smart Lockout uses cloud-based signals to distinguish genuine users from attackers even when both fail authentication. It tracks familiar and unfamiliar locations separately, meaning a user who always logs in from London will not be locked out by an attacker spraying from Eastern Europe.

Default Smart Lockout settings: 10 failures in 60 seconds triggers a 60-second lockout that doubles with each subsequent failure. Tune these in Entra ID under Security → Authentication Methods → Password Protection:

• Lockout threshold: reduce to 5 for high-security tenants
• Lockout duration (seconds): increase to 120 minimum
• Enable Entra ID Password Protection to block common passwords and custom banned terms (company name, city, product names)

3. Account Lockout for On-Premises AD (with Smart Thresholds)

Traditional AD lockout is a blunt instrument — spray campaigns deliberately stay under the threshold. The CISA-recommended approach combines a low lockout threshold (5–10 attempts) with Fine-Grained Password Policies that apply stricter thresholds to privileged accounts, plus monitoring-first to baseline normal failure rates before enforcing lockout.

The critical configuration for spray resistance is the Observation Window. Setting Lockout Observation Window to 30 minutes means the attempt counter resets every 30 minutes — which actually helps attackers who space their spray cycles. Set the observation window to match your longest expected spray cycle, or disable reset entirely (set to 0, which means it never resets without admin unlock for privileged accounts).

4. Block or Monitor Legacy Authentication Endpoints

Password spray campaigns disproportionately target legacy authentication endpoints because they bypass Conditional Access policies. The most commonly abused endpoints:

• Exchange ActiveSync (/Microsoft-Server-ActiveSync)
• Outlook Anywhere / MAPI over HTTP
• SMTP AUTH and POP3/IMAP
• OWA Basic Auth (now deprecated by Microsoft but still enabled in many on-premises Exchange installations)

Run this Exchange Online PowerShell command to identify accounts still using legacy auth:

Get-ConnectionInformation | Where-Object {$_.AuthenticationMethod -eq "Basic"} | Select-Object UserPrincipalName, ClientType, Protocol

Incident Response: The 48-Hour Spray Playbook

When a spray detection alert fires — or when a forensic investigation uncovers signs of historical spraying — act on this sequence:

1. Hour 0–2: Scope. Query SIEM for the full list of accounts targeted in the spray window, successful logins from the same source IPs, and any accounts that have authenticated from that IP since the attack began. Export to a spreadsheet.
2. Hour 2–6: Contain. Force password reset and session revocation on any accounts that authenticated successfully from attacker-controlled IPs. In Entra ID: Revoke All Refresh Tokens via PowerShell (Revoke-AzureADUserAllRefreshToken). On-premises AD: reset the password and verify no active Kerberos tickets remain by checking the krbtgt last-changed date.
3. Hour 6–12: Harden. Block the source IP ranges at perimeter firewall and Entra ID Named Locations. Enable MFA for any enrolled user who did not already have it. If legacy auth endpoints were used, disable them for the affected protocol.
4. Hour 12–24: Hunt. Assume at least one account was compromised before detection. Review authentication logs for lateral movement: new service principal creation, Conditional Access bypass via device registration, inbox rules forwarding email, or privilege escalation events.
5. Hour 24–48: Report and Improve. Document the timeline, indicators of compromise (IOCs), and detection gap that allowed the attack to proceed. If the spray ran for more than 24 hours before detection, the detection rules need tuning. File a change request to lower alert thresholds or increase log retention.

Password Manager Adoption: Closing the Spray-Enabling Gap

Password spraying succeeds because employees use predictable passwords that appear on every season-password list: Summer2026!, Company1!, Welcome123. Enterprise password managers eliminate the pattern by generating and storing random, unique passwords per account — so there is no common password to spray against.

Pairing your spray-blocking controls with an enterprise password manager like NordPass closes the human-behavior gap that technical controls alone cannot address. NordPass for Business includes a password health dashboard that flags reused and weak passwords across the organization — the same passwords that spray campaigns exploit.

Spray Defense Checklist

• MFA enforced for all privileged accounts with no exception in Conditional Access
• MFA enrollment underway for all standard user accounts (target 100%)
• Legacy authentication protocols blocked at Conditional Access or Exchange connector level
• Microsoft Entra Smart Lockout configured with threshold ≤ 10 and custom banned password list enabled
• SIEM alert live for distributed low-frequency failures (≥15 distinct accounts failing in 5 minutes)
• Microsoft Sentinel "Password spray against Azure AD application" analytic rule enabled
• DC Security event log forwarded to SIEM with Event IDs 4625, 4771, 4776 retained ≥ 90 days
• Entra ID Identity Protection Impossible Travel and Unfamiliar Sign-In risk policies set to Block or MFA challenge
• Fine-Grained Password Policy applied to privileged groups with lockout requiring manual admin unlock
• Incident response playbook documented, tabletop-tested, and accessible to the on-call team
• Password health dashboard reviewed monthly to identify accounts using common or reused passwords

Bottom Line

Password spraying is not a sophisticated attack. It is a deliberate, patient exploitation of the gap between how enterprise lockout policies are configured and how credential attacks are actually conducted. Nation-state actors and ransomware affiliates use it because it works — and because most organizations only detect it days or weeks after the fact, if at all.

Closing that gap requires three things together: MFA coverage that removes the value of a compromised password, detection rules tuned to horizontal spray patterns rather than per-account brute force, and a response playbook tested before the alert fires. None of these is complex to implement, but all three must be in place simultaneously. A well-configured Entra ID tenant with Smart Lockout, legacy auth blocked, and Sentinel rules active will stop virtually every commodity spray campaign at the perimeter. On-premises environments need the same principles applied through AD lockout policy, SIEM correlation, and network-layer controls on legacy endpoints.