Analytics Informational
✕

External Login Password Spray

An abnormally high amount of user account login attempts were seen on a host within a short period of time. This may have resulted from a login password spray attack.

Module:
Identity Analytics
Data source:
XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Brute Force: Password Spraying (T1110.003)
Attacker's goals:

An attacker may be attempting to gain unauthorized access to user accounts.

Investigative actions:

Check the amount of time in between each login attempt. Investigate the reason behind the login failures and if any accounts were locked out. Look for any successful login attempts and the ratio of login success versus login failures.

Test period:
1 Hour
Deduplication:
1 Day
6 variations:
  • External Login Password Spray Involving a Honey User Medium (parent: Informational)
  • External Login Password Spray from Multiple Source Hosts Informational
  • Successful External Login Password Spray on a Domain Controller Medium (parent: Informational)
  • Successful External Login Password Spray on a sensitive server Medium (parent: Informational)
  • Successful External Login Password Spray Low (parent: Informational)
  • External Login Password Spray on a Domain Controller Low (parent: Informational)