Password Spray
The Password Spray Detector identifies an attempt to steal account credentials by attempting logins using common account names and frequently used passwords. The detector monitors login events from multiple sources (Windows Active Directory, Cloud Authentication, endpoint, and others) and creates an alert when there are a high number of login attempts using multiple usernames from a single IP address during a small time window.
Password Spray Detector
Schema ⫘
Auth
Outputs ⫘
Alerts pushed to the Secureworks® Taegis™ XDR Alert Database and XDR Dashboard.
MITRE ATT&CK Category ⫘
MITRE Enterprise ATT&CK - Credential Access - Password Spraying. For more information, see MITRE Technique T1110.003.
Configuration Options ⫘
None