Question 1

What is password spraying?

Accepted Answer

Password spraying is an attack that tries the same weak password (Spring2024!, Welcome1, etc.) against a large number of accounts instead of trying every password against a single account. This technique avoids account lockout while compromising dozens of company accounts.

Question 2

What's the difference between password spraying and brute force?

Accepted Answer

Brute force tries thousands of passwords against a single account (triggers lockout). Password spraying tries 1 to 3 passwords against thousands of accounts (stays under the detection threshold). Spraying is stealthier and effective against corporate security policies.

Question 3

How do you detect a password spraying attack?

Accepted Answer

Detection signals: multiple simultaneous authentication failures across different accounts from the same IP, attempts at regular intervals (slow, to avoid lockout), activity outside business hours. Monitor Azure AD logs (Event ID 4625), Entra ID sign-in logs, and set up SIEM alerts.

Question 4

How do you protect against password spraying?

Accepted Answer

Protections: enforce complex, unique passwords (block common passwords via Azure AD Password Protection), enable mandatory MFA, configure Smart Lockout, monitor login attempts with a SIEM, and train users on secure passwords.

One common password.
An entire team exposed.

The attacker maps out your team

One common password.An entire team exposed.

The attacker maps out your team

One common password.
An entire team exposed.