# What is Password Spraying?

> Password spraying is an attack that tries a small set of common or likely passwords across many accounts, staying below per-account lockout thresholds while exploiting the statistical chance that some account uses a weak password.

- Canonical URL: https://yellowcube.eu/glossary/password-spraying/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Where credential stuffing replays known pairs, spraying guesses: a handful of seasonal or default passwords attempted against thousands of accounts. The pattern trades depth for breadth — few attempts per account, spread across the directory and often across source infrastructure to avoid rate controls.

Detection lives in aggregate: single failures are invisible, but one source failing across many accounts, or many sources each failing a few times per account, forms a recognizable shape. Defense combines eliminating weak and default passwords, phishing-resistant authentication for high-value accounts, lockout and throttling tuned to spray patterns, and monitoring for the aggregate signature.

### Key points

- **Pattern:** Small password sets tried against many identities, often federated or external-facing authentication points, spread over time and infrastructure to blend with normal failure rates.
- **Defensive controls:** Block weak and breached passwords when set and again at login, require MFA — phishing-resistant where risk warrants — throttle by source and by target, and alert on cross-account failure patterns.
- **Investigation:** Correlate authentication failures by source and target across time, look for the successful login among the failures, and check for service and legacy-protocol paths that bypass MFA.
- **Important limitation:** Rate limiting alone does not stop low-and-slow spraying, and MFA coverage gaps — legacy protocols, service accounts, exceptions — are exactly where spraying succeeds. A burst of failures can also be an artifact of a misconfigured client or a fleet of devices with expired credentials, not an attack.

### Related terms

[Brute-force attack](<https://yellowcube.eu/glossary/brute-force-attack/>) · [Credential stuffing](<https://yellowcube.eu/glossary/credential-stuffing/>) · [Login credentials](<https://yellowcube.eu/glossary/login-credentials/>) · [Account takeover (ATO)](<https://yellowcube.eu/glossary/account-takeover/>) · [Identity-based attack](<https://yellowcube.eu/glossary/identity-based-attack/>)

### Sources

[MITRE ATT&CK T1110.003: Password Spraying](https://attack.mitre.org/techniques/T1110/003/) · [CISA and NSA: Identity and Access Management Recommended Best Practices](https://www.cisa.gov/sites/default/files/2023-12/ESF%20IDENTITY%20AND%20ACCESS%20MANAGEMENT%20RECOMMENDED%20BEST%20PRACTICES%20FOR%20ADMINISTRATORS%20PP-23-0248_508C.pdf)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.