Detecting password spraying attacks within Active Directory environments

In a password spraying attack, attackers use one or a small list of commonly used or popular passwords against a large volume of usernames to acquire valid account credentials. This tactic can be used to obtain an initial access to an environment, and can also be used to escalate privileges when access has been already achieved.

In some scenarios, password spraying capitalizes on the password rotation security policies implemented by most organizations. As users change their passwords, it is possible that some pick predictable or seasonal passwords that match commonly used passwords on the attacker's password lists.

These searches detect possible password spraying attacks against Active Directory environments, using Windows Event Logs in the Account Logon and Logon/Logoff Advanced Audit Policy categories. The searches help identify instances where one source user, source host, or source process attempts to authenticate against a target or targets using an unusually high number of unique users, which is not common behavior for legitimate systems.