Use Case: Identity
Password spraying detection
One password tried against 3,000 accounts over 90 minutes. No lockouts. No per-account alerts. ManySignal saw the pattern across all 3,000 and blocked the source before account 800.
Below the lockout threshold, above the risk threshold
Password spraying is effective precisely because it exploits the design of per-account lockout policies. By limiting attempts to 1-3 per account across thousands of accounts, the attacker generates dozens of failed logins per account — well below any lockout threshold — while testing the entire user directory in a matter of hours.
Common spray passwords include current season/year combinations (Winter2024!, Summer2025), company name variants (Acme123!), and passwords from previous breach datasets affecting the same organization. Discovery of a single valid credential is often enough for the attacker to gain a foothold and begin lateral movement.
rule: password_spray_cross_account
type: cross-account correlation
sources:
- okta_system_log
- microsoft_entra_signin
- exchange_ews_logs
- google_workspace_login
trigger:
- event: authentication.failed
- condition: |
count(distinct users, failed_auth) > 20 WITHIN 60m
FROM same_source_ip OR same_source_asn
AND avg_attempts_per_user < 3
enrichments:
- source_ip_reputation: virustotal, shodan, recorded_future
- username_pattern: directory_match, linkedin_scrape_indicators
- success_check: any_auth_success DURING spray_window
mitre: T1110.003 (Password Spraying)How many unique accounts received a failed authentication from this source IP in the past hour?
IdP audit logIs the source IP associated with a known credential-stuffing or spraying service?
Threat intelDid any accounts succeed after the failed spray? If so, which?
IdP event correlationWas the spray targeting a specific endpoint — /authorize, /oauth/token, OWA, or EWS?
App access logAre the attempted usernames from a public employee directory or LinkedIn scrape?
Username pattern analysisHas this IP pattern appeared in spraying activity against other organizations?
Threat intel sharingBlock the source IP range at the IdP and WAF layer
AutonomousEnable lockout-threshold alerts for accounts that received >3 failed attempts
AutonomousForce MFA step-up for any account that successfully authenticated during the spray window
AutonomousIf success detected: immediately open full account compromise investigation
Approve-gatedNotify affected account owners of the spray attempt
RecommendMITRE ATT&CK mapping
Password spraying FAQ
How is password spraying different from brute force, and how does detection differ?
Brute force tries many passwords against one account — lockout policies catch it. Password spraying tries one or few passwords against many accounts, staying below lockout thresholds on each individual account. Detection requires cross-account correlation rather than per-account failed login counting.
Does ManySignal detect spraying via legacy protocols like IMAP and BasicAuth?
Yes. Exchange Online and Google Workspace legacy protocol authentication (IMAP, POP3, SMTP AUTH, BasicAuth) is monitored specifically because these bypass MFA. Spraying via legacy protocols is one of the most effective techniques because it sidesteps modern identity controls entirely.
What spray rate is too low to detect?
Sophisticated attackers use slow sprays — one attempt per account per day — to stay under statistical thresholds. ManySignal uses a multi-window analysis (hourly, daily, weekly) and correlates with threat intel on the source IP. A known spray infrastructure IP triggers an alert even for a single attempt.
Can ManySignal identify which accounts are at risk before a spray succeeds?
ManySignal's HIBP integration flags accounts whose credentials appear in breach datasets. These accounts are pre-identified as high-risk targets and receive enhanced monitoring. When a spray targets them, the risk score is elevated immediately.
Detect spraying before any account is compromised
Cross-account correlation across your entire user directory — not per-account failed login counting.