Password Spraying

Instead of trying many passwords against one account (which locks it out), password spraying tries one common password like Winter2026! against every account in a directory, staying under the lockout threshold the whole way. It’s a common first foothold into Active Directory, and the valid usernames it confirms feed straight into AS-REP roasting. It’s a cousin of brute force (many guesses, one account) and credential stuffing (known-valid pairs, many sites).

How It Works

• Enumerate valid users via LDAP, Kerberos pre-auth responses, or OWA/autodiscover timing differences.
• Pick likely passwords — seasonal patterns, company name, current year — the handful every org’s users gravitate toward.
• Go low-and-slow, spacing attempts per account well below the lockout counter.
• Ride the reset window, spraying again just after each lockout-counter reset to stay invisible.
• Target cloud/SSO portals, which often lack the same lockout tuning as on-prem AD.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

How to Detect It

• Alert on many Event ID 4625 failures where one password pattern hits many distinct accounts spread over time.
• Correlate failed logons across multiple services (VPN, OWA, SSO) from a single source.
• Watch cloud sign-in logs for impossible-travel or single-IP fan-out across many usernames.

How to Defend Against It

• Ban weak and breached passwords, and push long passphrases with MFA everywhere spraying could land.
• Deploy smart lockout that recognizes the spray pattern instead of only counting per-account failures.
• Monitor every authentication endpoint — VPN, OWA, SSO — as one surface, not separate silos.

Validating Your Defenses

An authorized spray against a seeded password policy shows whether lockout and MFA actually catch the pattern before an account falls. Log every account tried and the point of detection so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.