The Assumption That Breaks Your Detection Before the Attack Starts
Most security teams configure their password spray detection around a single premise: too many failed logins from one source should trigger an alert. That logic feels sound until you watch an actual spray campaign run against a modern authentication stack and realize that premise describes what attackers stopped doing several years ago. The failed-login threshold is not a detection control at this point. It is a monument to how spray campaigns used to look before threat actors learned to read your SIEM output better than your analysts do.
Password spray works by trying one password against many accounts rather than many passwords against one account. The attack sidesteps lockout policies precisely because it never hammers a single account long enough to hit the threshold. The detection gap exists not because the tools are wrong but because the logic underneath them models a different attack. This article is about rebuilding that logic from the authentication layer outward, with specific attention to the behavioral signals that mature spray campaigns generate and that most detection stacks underweight.
Why the Current Threat Landscape Raises the Stakes
The July 2025 threat intelligence cycle has surfaced several converging pressures that make password spray more operationally attractive to a broader range of threat actors. Southeast Asian cybercriminal syndicates, which have expanded from regional fraud operations into globally networked initial-access brokers, increasingly use spray campaigns as a first-stage technique for establishing footholds they then sell downstream. These groups operate with resources and coordination that allow them to run multi-tenant spray infrastructure across dozens of countries simultaneously, making source-IP-based detection even less reliable than it was.
The recent disclosure that a modified version of the CIA's Hive attack toolkit has entered criminal markets adds another dimension. Toolkits that were once the domain of nation-state operators are now accessible to financially motivated actors who can use them to anonymize and distribute authentication traffic in ways that evade traditional rate-limiting controls. Mirage Kitten's active campaigns targeting the Middle East and Africa region further illustrate that spray is a technique shared across threat categories, from nation-state intrusion teams to criminal syndicates, because it works quietly and at scale when defenders are looking at the wrong signals.
Microsoft's record patch release this month, covering 570 security flaws, also matters here. When patch cycles accelerate and administrator attention concentrates on vulnerability remediation, credential-based attack detection often receives less review time. Spray campaigns frequently intensify during periods when defenders are stretched, because the operational tempo of patching creates noise that buries authentication anomalies.
What a Spray Campaign Actually Looks Like in Your Logs
Before building detection, you need an accurate model of what you are detecting. A well-executed spray campaign against an enterprise environment in 2025 typically exhibits the following characteristics.
Authentication attempts arrive distributed across many source IPs, often spanning multiple ASNs and geographic regions. The attempts target valid usernames, which attackers enumerate beforehand through open sources, LinkedIn scraping, or previously leaked directories. Each account receives one or two authentication attempts per cycle, spaced to stay below any per-account lockout threshold. The attempts often use a single seasonally plausible password, such as a month-year combination, a commonly known corporate default pattern, or a password derived from a recent public breach list.
The campaign frequently runs during local business hours in the target organization's time zone, because successful authentications need to blend with legitimate login activity. After a failed cycle, attackers rotate the password and wait, sometimes days, before the next pass. Successful authentications generate minimal additional noise in the short term because the attacker's next move is observation, not immediate lateral movement.
This behavioral profile means your logs contain the evidence, but the evidence is distributed across time, accounts, and source addresses in a way that no single event fires a threshold. The detection has to be correlative and temporal rather than reactive and threshold-based.
Building Detection That Actually Catches Distributed Spray
Authentication Velocity Across Account Populations
The foundational signal for spray detection is authentication velocity measured across accounts rather than per account. Instead of counting failed logins against a single username, your detection logic should count how many distinct accounts received at least one authentication attempt within a rolling time window from any source. A baseline that reflects your organization's normal authentication volume makes this detection far more precise.
In practical terms, this means querying your identity provider or SIEM for a count of distinct accounts that received authentication events, successful or failed, within a 15-minute window, and comparing that count to the same window across the prior 30 days. A sudden expansion in account population touched during an interval, even with a low per-account failure rate, is a spray signal. This query can run against Azure AD sign-in logs, Okta system logs, or on-premises Active Directory event logs with equal effectiveness.
Password Reuse Rate Across Authentication Events
If your authentication infrastructure logs credential hash data or if you have access to authentication attempt metadata, tracking password reuse across accounts is the most direct spray indicator available. A legitimate user population trying to log in produces a distribution of passwords. A spray attack produces a spike in a single password value appearing across many accounts in a short period. Even without raw password data, some identity providers expose attributes that let you infer this, such as identical failure codes correlated with the same client application version or authentication flow type across many accounts simultaneously.
Source Diversity Correlation
Spray campaigns that use distributed infrastructure generate a characteristic pattern: high account coverage combined with high source IP diversity within a short window. A single user having a bad day might fail from one IP across three accounts. A spray campaign generates coverage across dozens or hundreds of accounts from dozens of sources. The ratio of distinct source IPs to distinct target accounts during a window outside your normal range is a detection signal that most teams have not formalized into a rule.
This detection requires enriching your authentication logs with ASN data. When the source IPs span five or more ASNs, including residential proxy ranges, cloud provider egress ranges, and VPN exit nodes, during a period of elevated failed authentication volume, the combination is highly indicative. Threat intelligence feeds from services that classify IP ranges by hosting type help operationalize this enrichment without requiring custom infrastructure.
Successful Authentication Following a Failure Cluster
One of the most underutilized spray detection signals is the successful login that follows a spray cycle. When an account that received one failed authentication attempt three days ago logs in successfully from a new IP, especially outside business hours or from an unusual geographic location, that event is contextually suspicious in a way that neither event alone would indicate. Building detection that links these temporally separated events requires storing spray candidate events in a way that can be queried when subsequent authentication activity occurs against those same accounts.
This lookback detection is where UEBA platforms add genuine value. User and entity behavior analytics that maintain rolling baselines for individual accounts will flag the successful authentication from an unusual location as anomalous. When you cross-reference that anomaly with a prior failed-authentication event against the same account, the combined signal becomes an investigation trigger rather than just a noise event.
Identity Provider Configuration That Reduces Spray Exposure
Detection matters, but reducing the attack surface reduces the detection burden. Several identity provider configurations directly limit spray campaign effectiveness and are worth implementing regardless of your detection maturity.
Conditional access policies that require multi-factor authentication for all authentication flows, including legacy protocols, are the single highest-impact control. Spray campaigns succeed when the compromised password is sufficient to complete authentication. MFA requirement on every flow eliminates the majority of spray-to-compromise paths immediately. The persistent problem is that legacy authentication protocols, specifically SMTP AUTH, IMAP, POP3, and basic HTTP authentication, bypass modern MFA enforcement. Blocking legacy authentication at the identity provider level closes this gap. Microsoft's own data shows that disabling legacy auth in Azure AD blocks over 99 percent of password spray attacks that would otherwise succeed.
Named location policies that restrict authentication to expected countries or network ranges add friction without eliminating access for legitimate users. Combining location restrictions with device compliance requirements raises the cost of spray campaigns that use residential proxy infrastructure to simulate domestic traffic.
For on-premises Active Directory environments, Fine-Grained Password Policies applied to high-value accounts and service accounts reduce spray effectiveness by enforcing complexity that makes common seasonal passwords non-compliant for those accounts specifically.
Log Sources That Teams Consistently Miss
Many spray investigations stall because teams query the most obvious log source and conclude there is nothing to find. Complete spray detection requires visibility across a broader set of sources than most detection runbooks specify.
Office 365 and Microsoft 365 Unified Audit Logs capture authentication events across Exchange Online, SharePoint, Teams, and the Microsoft Authentication Library that sign-in logs sometimes miss, particularly for non-interactive sign-ins from applications. If your detection relies solely on the Azure AD interactive sign-in log, you are missing a substantial portion of the authentication surface that spray campaigns target.
VPN gateway authentication logs are frequently excluded from spray detection correlation because they sit in a different product team's infrastructure. Spray campaigns increasingly target VPN endpoints because successful VPN authentication provides network-level access with fewer downstream controls than a cloud application. Centralizing VPN authentication logs into your SIEM and applying the same population-level velocity queries against them closes this gap.
Application-level authentication logs for web applications that implement their own session management represent another blind spot. SaaS applications that handle their own authentication outside your identity provider generate spray-relevant events that never reach your central logging pipeline unless you configure the application to forward them. A comprehensive spray detection program audits every authentication surface and confirms that each one feeds the central detection environment.
Operationalizing Response When Detection Fires
Detection without a practiced response process creates alert fatigue and incomplete investigation. When a spray detection rule fires, the response sequence needs to be fast enough to catch in-progress campaigns while thorough enough to identify accounts that may have already been compromised.
The first step in response is confirming the spray pattern by pulling the full authentication event set for the detection window, including successful authentications. Any account that received a failed authentication attempt during the spray window and then had a successful authentication in the 24 to 48 hours following should be treated as potentially compromised and investigated immediately. This includes checking for inbox rule creation, email forwarding configuration, SharePoint access to sensitive content, and any OAuth token grants that occurred after the authentication.
The second step is blocking the infrastructure. While spray campaigns use distributed sources, the specific IPs observed during a detected campaign can still be blocked or rate-limited at the edge to interrupt an ongoing campaign. Feeding observed source IPs into your WAF or identity provider's named location block list for the duration of an active campaign limits the remaining attack window even when source rotation is occurring.
The third step is enforcing MFA across any account population that the spray touched, even for accounts where the authentication failed. Spray campaigns run multiple passes with different passwords. An account that failed once is a candidate for a future pass with a different credential. Requiring MFA re-enrollment or a password reset for the affected account population prevents the second pass from succeeding even if the first pass provided the attacker with valid username confirmation.
SMB-Specific Considerations
Cyber readiness for small and medium-sized businesses deserves specific attention in spray detection discussions because the attack pattern does not scale down the way defenders often assume it does. Spray campaigns targeting SMBs are operationally similar to those targeting large enterprises, but the defensive infrastructure is typically less mature. The absence of a SIEM, a UEBA platform, or a dedicated security team means the correlative detection described above requires adaptation.
For SMBs without centralized logging infrastructure, Microsoft 365 Business Premium includes Defender for Business with sign-in risk policies that implement population-level spray detection natively. Enabling risky sign-in policies and configuring them to require MFA remediation on medium and above risk scores provides meaningful spray detection without requiring custom detection engineering. Okta's free tier for small businesses includes similar risk-based authentication that catches spray patterns through built-in behavioral analysis.
Cloud-based identity providers have the cross-tenant visibility to identify spray campaigns targeting multiple organizations simultaneously, which means their built-in risk signals carry information that no single organization's local logs can generate. Trusting and acting on those risk scores rather than dismissing them as false positives is an underutilized defensive posture for resource-constrained environments.
Measuring Whether Your Detection Is Working
Detection programs that cannot measure their own effectiveness drift toward the same false confidence that allowed spray campaigns to succeed quietly. Establishing measurable baselines and testing cadences keeps spray detection calibrated against evolving attack techniques.
Purple team exercises specifically designed around spray simulation are the most direct measurement approach. Running a controlled spray simulation using a tool like Spray or MSOLSpray against a test account population, then measuring how long it takes your detection stack to fire and what information the alert surface, identifies gaps before an actual attacker does. This exercise should run at least quarterly, and the results should feed directly into detection rule tuning.
Tracking your mean time to detect for spray campaigns, using historical incident data or simulation results, gives leadership a concrete metric for authentication security posture. As spray techniques evolve, particularly with AI-assisted password generation that produces more contextually plausible candidates, detection rules need to keep pace. The AI-assisted attack surface expanding rapidly in 2025 means that password candidates derived from organizational data, public social media, and employee profile scraping will become more common and more targeted than the seasonal-password approach that characterized spray campaigns historically.
Closing the Gap Between Detection and Reality
Password spray remains one of the most consistently successful initial access techniques because the detection logic deployed against it most commonly models what the attack looked like years ago. Organizations that build detection around failed-login thresholds per account, single-source blocking, and reactive IP blocklisting are running controls calibrated for a technique that threat actors have already adapted past.
The practical path forward is correlative detection across account populations, MFA enforcement including legacy protocol blocking, cross-surface log centralization, and a practiced response process that treats any account touched by a spray window as potentially compromised until investigation clears it. That combination addresses what spray campaigns actually look like in 2025, rather than what the original threshold logic was designed to catch.
