Techniques › T1110 › T1110.003

T1110.003 Password Spraying

credential access — Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0487 Distributed Password Spraying via Authentication Failures Across Multiple Accounts v1.0
  AN1336 Windows

  A high volume of authentication failures using a single password (or small set) across many different user accounts within a defined time window

  WinEventLog:Security EventCode=4625, 4771, 4648 → DC0002 User Account Authentication

  Tunable: PasswordReuseThreshold TimeWindow TargetGroupFilter
  AN1337 Linux

  Authentication failures across different accounts using a repeated or similar password via SSH or PAM stack within a short window

  linux:syslog Failed password for invalid user → DC0002 User Account Authentication

  Tunable: PasswordReusePattern IPAggregationWindow
  AN1338 macOS

  Multiple failed login attempts across different users using common password patterns (e.g., 'Welcome2023')

  macos:unifiedlog Login Window and Authd errors → DC0002 User Account Authentication

  Tunable: RetryCountThreshold CommonPasswordList
  AN1339 Identity Provider

  Sign-in failures across enterprise SSO applications or SaaS platforms from same IP address using the same password against multiple user identities

  azure:signinlogs Failure Reason + UserPrincipalName → DC0002 User Account Authentication

  Tunable: GeoIPAnomalyCheck FailedUserRatio
  AN1340 Network Devices

  Authentication failure logs on routers/switches showing repeated use of default or common passwords across multiple accounts

  networkdevice:syslog AAA or TACACS authentication failures → DC0002 User Account Authentication

  Tunable: AuthFailureBurst InterfaceFilter
  AN1341 Containers

  Repeated failed authentication attempts to container APIs, control planes, or login shells across many user names using same password

  kubernetes:audit Failed login → DC0002 User Account Authentication

  Tunable: OrchestrationScope ServiceAccountFilter
  AN1342 Office Suite

  Failed authentication attempts across user mailboxes using identical or common passwords (e.g., OWA brute attempts)

  m365:exchange FailedLogin → DC0002 User Account Authentication

  Tunable: MailboxAccessAttempts EmailPatternAnalysis
  AN1343 SaaS

  SaaS applications receiving authentication failures for dozens of accounts using same password or login signature

  saas:auth signin_failed → DC0002 User Account Authentication

  Tunable: CloudAppScope UserPopulationSensitivity

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1110.003

Rules tagged at the parent level (attack.t1110) 25

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.