ATT&CK coverage › Technique
Brute Force: Password Spraying T1110.003
Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.
Events covered
8 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 23 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (25 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (38 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Common exclusions (17 distinct)
Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Elastic 3 rules
- Multiple Logon Failure Followed by Logon Success
- Multiple Logon Failure from the same Source Address
- Privileged Accounts Brute Force
Splunk 19 rules
- Detect Password Spray Attack Behavior From Source
- Detect Password Spray Attack Behavior On User
- Detect Password Spray Attempts
- Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
- Windows Multiple Invalid Users Fail To Authenticate Using Kerberos
- Windows Multiple Invalid Users Failed To Authenticate Using NTLM
- Windows Multiple Users Fail To Authenticate Wth ExplicitCredentials
- Windows Multiple Users Failed To Authenticate From Host Using NTLM
- Windows Multiple Users Failed To Authenticate From Process
- Windows Multiple Users Failed To Authenticate Using Kerberos
- Windows Multiple Users Remotely Failed To Authenticate From Host
- Windows Unusual Count Of Disabled Users Failed Auth Using Kerberos
- Windows Unusual Count Of Invalid Users Fail To Auth Using Kerberos
- Windows Unusual Count Of Invalid Users Failed To Auth Using NTLM
- Windows Unusual Count Of Users Fail To Auth Wth ExplicitCredentials
- Windows Unusual Count Of Users Failed To Auth Using Kerberos
- Windows Unusual Count Of Users Failed To Authenticate From Process
- Windows Unusual Count Of Users Failed To Authenticate Using NTLM
- Windows Unusual Count Of Users Remotely Failed To Auth From Host