Password spraying
Password spraying is like a brute force attack and can help attackers identify and abuse accounts with weak passwords. Password spraying is a slow and methodical approach where the attacker tries a list of common and known passwords on a large number of accounts. In contrast, a brute force attack involves an attacker trying a large number of potential passwords, typically against a single account, in rapid succession.
If a login is successful using such a guessed password, the attacker gains control over the designated account and can use it to move laterally and get more credentials or interesting data.
There are many open source scripts and modules available that adversaries can use for a password spray attack, including the following:
- https://github.com/dafthack/domainPasswordSpray
- https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon
Mitigation
It is hard to detect password spraying in your on-prem AD. Although you can see...
