Detecting password spraying
You group failed logons in the log by source address and number of target accounts, tell the attack apart from one-off mistakes, find the attack’s time window and the account where it succeeded, turn the detection into a reusable script and write the response report. The attacker’s address and the compromised account differ in every lab.
Level 201 · 45 min
Password spraying means trying one or two common passwords on many accounts (e.g. "Bahar2026!") instead of many passwords on one account, to avoid lockouts. Because each account sees only one failed logon, each looks like a typo on its own.
Analogy: a burglar tries the same key once on every door in a building. Looking at one door you’d say "someone tried the wrong door"; seeing all the doors together reveals the attack. Detection works the same way: you group events by source address.
In this domain account lockout is off (you found that in the earlier lessons), so the attacker can try freely. The log is again in ~/logs/security.jsonl.
What you will do in this lesson
- Where do the failed logons come from?
- Wrong password or non-existent user?
- How many different accounts?
- The attack’s time window
- The attacker’s address
- The compromised account
- Write a detection rule
- The response report
- Short quiz
Skills you will earn
- Detecting password spraying in a log
- Reading failed logons and their reasons (4625, SubStatus)
- Answering who, whom, from where and when for an incident
- Turning a detection into a script
- Writing audit findings into a report
← Windows event IDs that matter for AD · Active Directory security: auditing and hardening · Detecting and preventing Kerberoasting →
Start for free