Overview
This guide contains helpful tips for investigating “Password Spraying” findings. It includes helpful tips to identify the source of password spraying and common scenarios that trigger the findings, so you can take action depending on the source of the activity.
This guide supports investigating findings for the following detection rules:
-
Password Spraying - 4625 & 4648
-
Password Spraying - 4625 & 4771
Reviewing the evidence to identify the source
To begin investigating a password spraying finding, review the Matched Evidence table in the finding and identify the source of the activity, which can be found in the client_ip and workstation_name fields of the table.
Events that can trigger “Password Spraying” findings
After verifying the source device, consider its potential uses. Below are some popular scenarios depending on what the source device is, and tips for responding to each.
| Scenario | Considerations and Response |
| Vulnerability scanner |
If the source device has a vulnerability scanner installed, this activity is likely related to the vulnerability management software performing a scan. Review the vulnerability management software’s scan history to see if the software initiated a scan around the time the finding was generated. Consider creating a detection filter for the client IP address. |
| Firewall |
If the source device is a firewall, the finding was likely caused by an external actor failing to log in to the firewall. Investigating the firewall logs is necessary to identify the source of the login failures. The most popular occurrence is login failures from outside of your expected location, such as from outside the United States. Consider implementing geo-IP filtering to reduce the login failures. You can block the source of the logins, although this method will likely not reduce noise in the long term. |
| Penetration tests |
This finding often occurs during penetration tests. If your organization is undergoing a penetration test, confirm with the penetration testing team if the source device is being used for the test. Depending on the length of the penetration test, resolving these findings without implementing a detection filter is recommended to maintain detection visibility if the device being used by the penetration testing team is a standard-use device that will be returned to normal use after the test. However, a temporary detection filter can be implemented and removed after the test if frequent findings are being generated and causing too much noise for your team. |
| Logging not configured on source device | If the source device is not expected to conduct this activity and is not sending logs, configuring the device to send logs will assist in identifying what is causing the activity on that device. |
Adding a detection filter
Detection filters for password spraying detections are usually created by excluding the activity for a specific client_ip, such as in this example filter, where 10.0.0.8 is a vulnerability scanner.
Example: client_ip – Equal – 10.0.0.8