The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Detect password spraying by looking for failed sign-ins across many distinct accounts, then grouping those attempts by source, application, user agent, location and timing. A per-account retry threshold alone can miss the pattern. There is no universal failure count or time window: compare activity with your organization’s normal authentication behavior, and investigate any successful credential validation among the targeted accounts.
What password spraying looks like in logs
Password spraying is an attempt to use a small set of likely passwords against many accounts. That differs from brute force, which typically tries many passwords against one or a few targeted accounts. Microsoft describes this distinction in its account security guidance.
As an Amazon Associate I earn from qualifying purchases.
The key signal is therefore not simply “many failures.” It is an unusual number of distinct accounts receiving failures that share a source or other context within a relevant period. The attempts may arrive in a burst or be spread out to avoid simple lockout and retry rules. Microsoft’s password-spray investigation guidance recommends examining repeated attributes and timing, including low-and-slow patterns.
Which authentication records to collect
Start by mapping the systems and protocols that handle authentication in your environment. A useful detector depends on having records from the path the sign-in actually took; no single event list applies to every protocol.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Microsoft Entra: Review sign-in records and relevant Identity Protection risk detections. Microsoft’s Identity Protection investigation guidance defines its password-spray detection as observed spray activity with successful credential validation against a user in the tenant.
- AD FS: Ensure auditing captures enough detail to investigate failures. Microsoft recommends higher logging detail and central correlation because basic AD FS auditing may not provide sufficient investigation context.
- On-premises Windows authentication: Use the event sources applicable to the observed authentication protocol. MITRE’s distributed password-spraying detection strategy identifies Windows Security events 4625, 4771 and 4648 as relevant data components. Treat them as candidate sources, not a universal or exhaustive list.
- Applications and network services: Include their authentication records when they are in scope, especially if they do not rely on the identity systems above.
Where possible, centralize these records so that failures from different systems or identity paths can be correlated. Microsoft recommends SIEM correlation with domain authentication and Entra sign-in records as part of its investigation guidance.
Build a detector around distinct accounts and context
Group failed authentication attempts over a time window and count distinct target accounts, rather than relying only on total retries for one account. Then add context that helps establish whether separate failures belong to the same activity.
- Target: Account and, where useful, account type or privilege level.
- Source: Source IP address or range, including related or distributed sources where your telemetry supports linking them.
- Authentication target: Application, service or identity provider.
- Client context: User-agent string and device information when available.
- Location: Sign-in geography, interpreted against normal user and organization behavior.
- Timing and outcome: Timestamps, intervals between attempts, failure type and any subsequent successful sign-in.
A practical analytic question is: “Did one source, or a related set of sources, fail against an unusual number of distinct accounts in a short or regularly spaced interval?” A detector that only groups by one IP can miss activity distributed across addresses. MITRE’s strategy explicitly treats aggregation window and password-reuse threshold as tuning parameters.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Microsoft Defender for Identity publishes a sample password-spray hunting query for distinct-account failed-logon anomalies. Treat it as an example to adapt to your telemetry and baseline, not as a universal rule.
Look for low-and-slow attempts
When account lockouts or simple bad-password thresholds do not fire, inspect the sequence and shared attributes of failures. Password spraying may be paced to keep each account’s retry count low.
- Check whether targeted accounts recur in a repeated directory or other consistent order.
- Compare the user agent, application, IP range and location across failed attempts.
- Look for unusually regular spacing between attempts, including across multiple accounts.
- Check whether the activity aligns with known authentication clients, service-desk password resets or other expected operations.
These clues indicate a pattern to investigate; none proves an attack by itself. Compare them with operational activity and known client behavior to reduce false positives.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Investigate any successful credential validation
Search the targeted accounts for successful sign-ins, particularly successes following related failures. A valid password does not by itself establish that an account was taken over, but it changes the priority of the investigation. Microsoft Entra Identity Protection uses “password spray” for observed spray activity that achieved successful credential validation against a tenant user.
For a potentially related success, examine MFA results, source and location, device, browser, application, and whether the context is familiar for that account. Then review subsequent resource access for activity the user would not normally perform. Microsoft’s incident-response guidance notes that a correct password followed by failed MFA may indicate that an attacker has the password even though access was not completed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Tune alerts to your environment
Neither Microsoft’s guidance nor MITRE’s detection strategy establishes one failure count or time window that works everywhere. Choose thresholds and aggregation windows using local behavior, and revisit them as patterns change.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Baseline failed-password frequency and ordinary sign-in behavior.
- Account for expected egress IPs, normal user geography, applications and authentication clients.
- Review MFA attempt patterns and routine password-reset or service-desk activity.
- Set more sensitive handling for privileged accounts where appropriate.
- Track false positives and coverage gaps after deployment, and adjust the rule rather than assuming a threshold from another organization will transfer.
Microsoft recommends defining baselines for user behavior, failed-password frequency, MFA attempts, known egress IPs and user geography, then tailoring thresholds to organizational behavior.
Distinguish a spray from routine errors and brute force
Use the overall pattern, not one field in isolation. Routine user mistakes are more likely to be localized to the affected accounts or known clients; a spray is more concerning when failures span many distinct accounts and share unusual source, application, client or timing context. Brute force is more strongly associated with many password attempts against a targeted account or small set of accounts. These are investigative distinctions, not guarantees: validate against your own baseline and inspect any successful sign-in.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
References
- Microsoft Learn: Password spray investigation
- Microsoft Learn: Microsoft Entra security operations for user accounts
- MITRE ATT&CK: DET0487 distributed password-spraying detection
- Microsoft Defender for Identity: Password Spray hunting query
- Microsoft Learn: Investigate risk with Microsoft Entra ID Protection
- MITRE ATT&CK: T1110.003 Password Spraying
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
