Where credential stuffing replays known pairs, spraying guesses: a handful of seasonal or default passwords attempted against thousands of accounts. The pattern trades depth for breadth — few attempts per account, spread across the directory and often across source infrastructure to avoid rate controls.
Detection lives in aggregate: single failures are invisible, but one source failing across many accounts, or many sources each failing a few times per account, forms a recognizable shape. Defense combines eliminating weak and default passwords, phishing-resistant authentication for high-value accounts, lockout and throttling tuned to spray patterns, and monitoring for the aggregate signature.
Key points
PatternSmall password sets tried against many identities, often federated or external-facing authentication points, spread over time and infrastructure to blend with normal failure rates.
Defensive controlsBlock weak and breached passwords when set and again at login, require MFA — phishing-resistant where risk warrants — throttle by source and by target, and alert on cross-account failure patterns.
InvestigationCorrelate authentication failures by source and target across time, look for the successful login among the failures, and check for service and legacy-protocol paths that bypass MFA.
Important limitationRate limiting alone does not stop low-and-slow spraying, and MFA coverage gaps — legacy protocols, service accounts, exceptions — are exactly where spraying succeeds. A burst of failures can also be an artifact of a misconfigured client or a fleet of devices with expired credentials, not an attack.