One Password, Many Doors: Detecting a Password Spray
The challenge
Veltro's SSO logged a quiet minute just after eight: a single address tried to sign in as a long list of different staff, one go each, and moved on. This is not someone hammering one account until it breaks; it is someone trying one password they already have against everyone, knowing most will not match but someone's will. Almost all of those attempts failed. One did not. Find the account that let them in.
What you'll learn
- Distinguish password spraying (broad) from brute force (deep)
- Filter a SIEM by source address to isolate one actor's attempts
- Recognise one source touching many distinct usernames as the spray signal
- Tell an ordinary failed-then-succeeded retry apart from an attack
- List the defences: per-source limits, MFA, breached-password bans
Skills tested
Prerequisites
- Reading tabular log events
- What a login success/fail means
How it works
Brute force guesses many passwords against one account and quickly trips lockouts. Password spraying inverts it: take one password that is likely to be in use somewhere, and try it once against a long list of accounts. No single account sees more than one failure, so per-account lockouts never fire.
The signal moves from depth to breadth. Instead of one username with many failures, you see one source address cycling through many different usernames in a tight window, almost all failing, with the occasional success where an account happened to use that password.
Reading the log by source rather than by account is what makes the pattern obvious.
Common mistakes
- Looking for many failures on one account. That is brute force; a spray shows one failure each across many accounts.
- Flagging
s.radev. They fail once then succeed from their own address: a normal retry, not the spray source. - Answering the attacker IP. The question asks which account was compromised, not the source.
- Missing the single success. Within the burst, nine fail and only one succeeds; that user is the answer.
How to defend against it
Detect breadth and remove the easy win.
- Rate limit and alert per source address, not only per account, and flag any single source attempting many distinct usernames in a short window.
- Require multi-factor authentication so a matched password alone does not grant access.
- Ban known-breached and weak shared passwords, which are what make a single sprayed guess land.
- Lock or step up accounts that succeed from an address seen failing against many others.