Analytics Informational
✕

Internal Login Password Spray

An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack.

Module:
Identity Analytics
Data source:
XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Brute Force: Password Spraying (T1110.003)
Attacker's goals:

An attacker may be attempting to gain unauthorized access to user accounts.

Investigative actions:

Check the amount of time in between each authentication attempt. Investigate the reason behind the login failures and if any accounts were locked out. Look for any successful authentication attempts and the ratio of login success versus login failures. Monitor for potential abuse of MFA on users who have successfully logged in.

Test period:
1 Hour
Deduplication:
1 Day
5 variations:
  • Suspicious intensive and short internal Login Password Spray Medium (parent: Informational)
  • High-Volume Internal Password Spray Attack Medium (parent: Informational)
  • Internal Login Password Spray with many wrong password attempts Low (parent: Informational)
  • Internal Login Password Spray attempt on local user Low (parent: Informational)
  • Internal Login Password Spray on many users Low (parent: Informational)