T1110.003 — Password Spraying

Tactic: Credential Access · Platforms: Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the…

Sub-technique of Brute Force (T1110).

Sigma detection rules (8)

title: "T1110.003 Brute Force: Password Spraying"
id: e5289bfa-9bfe-44d9-8c41-30fddd0e4aa7
description: 'Detects invalid-credential authentication failures (bad password on 4625, Kerberos pre-authentication failure on 4771) that are the concrete precursor signal for password spraying; 4648 (explicit credential logon) is not a failure indicator and has been removed. Pair with a value_count correlation on TargetUserName grouped by source IP/workstation to confirm the multi-account fan-out. (Data Component: User Account Authentication; baseline tier: windows-eventid.) Tune using: PasswordReuseThreshold, TimeWindow, TargetGroupFilter.'
references:
  - https://attack.mitre.org/techniques/T1110/003
author: Shahrukh Khan
date: 2026-03-16
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.003

logsource:
  product: windows
  service: security

detection:
  selection_4625_bad_password:
    EventID: '4625'
    SubStatus|contains:
      - '0xC000006A'

  selection_4771_preauth_failed:
    EventID: '4771'
    Status|contains:
      - '0x18'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (selection_4625_bad_password or selection_4771_preauth_failed) and not filter_system_account

falsepositives:
  - Helpdesk password resets or a stale cached credential hitting many accounts; confirm with a distinct-account/source correlation before escalating.

level: medium

title: "T1110.003 Brute Force: Password Spraying"
id: f238e59a-1df6-47d4-9cad-0bcd9b88374c
description: 'Distributed Password Spraying via Authentication Failures Across Multiple Accounts. The prior version matched "Failed password for" — any single failed login regardless of target — identical in substance to the companion Credential Stuffing rule and equally untied to the spraying behavior of one or a few passwords tried across many accounts. This version narrows the base signal to failed logins against valid, existing local accounts (excluding "invalid user" failures, the more typical signature of credential stuffing against non-existent accounts), providing a more relevant, though still single-event, building block for the same-password-many-accounts aggregation that must happen in the SIEM correlation layer. Tune using: PasswordReusePattern, IPAggregationWindow.'
references:
  - https://attack.mitre.org/techniques/T1110/003
author: Shahrukh Khan
date: 2026-06-06
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.003

logsource:
  product: linux
  service: syslog

detection:
  selection:
    Message|contains: 'Failed password for'
  filter_invalid_user:
    Message|contains: 'invalid user'

  condition: selection and not filter_invalid_user

falsepositives:
  - A single event only shows one failed login against one valid local account; confirming genuine password spraying still requires SIEM-side aggregation of the same password (or a small common-password set) attempted across many distinct valid accounts from one source within a short window, a pattern that cannot be expressed as a single auditd/syslog field match.

level: medium

title: "T1110.003 Brute Force: Password Spraying"
id: 14f34df9-a61c-4fd1-9a33-269235c7aa39
description: 'Distributed Password Spraying via Authentication Failures Across Multiple Accounts. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: RetryCountThreshold, CommonPasswordList.'
references:
  - https://attack.mitre.org/techniques/T1110/003
author: Shahrukh Khan
date: 2026-01-29
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/su'

  condition: selection

falsepositives:
  - Single-event visibility cannot separate spraying across many accounts from routine su usage without cross-account correlation.

level: medium

title: "T1110.003 Brute Force: Password Spraying"
id: 2e3cbf33-680c-46a0-85b3-6b22eb44629f
description: 'Distributed Password Spraying via Authentication Failures Across Multiple Accounts. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: CloudAppScope, UserPopulationSensitivity.'
references:
  - https://attack.mitre.org/techniques/T1110/003
author: Shahrukh Khan
date: 2026-05-03
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.003

logsource:
  product: saas
  service: auth

detection:
  selection:
    event_type: 'login_failure'

  condition: selection

falsepositives:
  - Detecting the spray pattern itself requires aggregating failures across many distinct user accounts from a small set of source IPs over a short window, which needs historical baselining beyond this single-event rule; a mass forced password rotation can otherwise look similar.

level: medium

title: "T1110.003 Brute Force: Password Spraying"
id: 3d3f211e-9c9f-4025-8ef3-655e427c91d7
description: 'Distributed Password Spraying via Authentication Failures Across Multiple Accounts. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: GeoIPAnomalyCheck, FailedUserRatio.'
references:
  - https://attack.mitre.org/techniques/T1110/003
author: Shahrukh Khan
date: 2026-05-14
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.003

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ResultType: '50053'

  condition: selection

falsepositives:
  - A password policy rollout or expired shared service account credentials causing simultaneous lockouts across many accounts.

level: medium

title: "T1110.003 Brute Force: Password Spraying"
id: 407a0337-7d43-4cce-94a9-6959cbe4a166
description: 'Distributed Password Spraying via Authentication Failures Across Multiple Accounts. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: MailboxAccessAttempts, EmailPatternAnalysis.'
references:
  - https://attack.mitre.org/techniques/T1110/003
author: Shahrukh Khan
date: 2026-06-18
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.003

logsource:
  product: m365
  service: exchange

detection:
  selection:
    Operation: 'MailboxLogin'

  condition: selection

falsepositives:
  - Exchange mailbox audit logging only records successful logins, so failed spray attempts are not visible here, limiting this rule to post-compromise access.

level: low

title: "T1110.003 Brute Force: Password Spraying"
id: 519f7b20-e3b4-49d3-af80-5d4716a1eccb
description: 'Distributed Password Spraying via Authentication Failures Across Multiple Accounts. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: AuthFailureBurst, InterfaceFilter.'
references:
  - https://attack.mitre.org/techniques/T1110/003
author: Shahrukh Khan
date: 2026-05-15
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.003

logsource:
  product: networkdevice
  service: syslog

detection:
  selection_burst:
    Message|contains: '%SEC_LOGIN-4-LOGIN_FAILED'
  selection_manyaccounts:
    Message|contains: 'Login failed'

  condition: 1 of selection_*

falsepositives:
  - An automated configuration management tool misconfigured with stale credentials attempting logins across many device accounts will also match.

level: medium

title: "T1110.003 Brute Force: Password Spraying"
id: 926732fe-64af-4228-a9bd-5523fe0e7000
description: 'Distributed Password Spraying via Authentication Failures Across Multiple Accounts. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: OrchestrationScope, ServiceAccountFilter.'
references:
  - https://attack.mitre.org/techniques/T1110/003
author: Shahrukh Khan
date: 2026-02-03
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.003

logsource:
  product: kubernetes
  service: audit

detection:
  selection:
    responseStatus.code: 401
    user.groups|contains: 'system:serviceaccounts'

  condition: selection

falsepositives:
  - Misconfigured or expired service account tokens causing transient authentication failures with no malicious intent.

level: medium

Related sub-techniques

• T1110.001 Password Guessing
• T1110.004 Credential Stuffing
• T1110.002 Password Cracking

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1110.003 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan