<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Password Spray Detection — API Reference

## Windows Event IDs

| Event ID | Description | Key Fields |
|----------|-------------|------------|
| 4625 | Failed logon | SubStatus=0xC000006A (bad password) |
| 4771 | Kerberos pre-auth failed | Status=0x18 (bad password) |
| 4776 | NTLM credential validation | Status=0xC000006A |
| 4624 | Successful logon | LogonType 3=Network, 10=RDP |

## SIEM Queries

### Splunk
```spl
index=wineventlog EventCode=4625 SubStatus=0xC000006A
| bin _time span=30m
| stats dc(TargetUserName) as users count by src_ip _time
| where users > 15 AND count/users < 3
```

### Elastic / KQL
```kql
event.code: "4625" AND winlog.event_data.SubStatus: "0xC000006A"
| stats count(*), count_distinct(winlog.event_data.TargetUserName) by source.ip
```

### Microsoft Sentinel
```kql
SecurityEvent
| where EventID == 4625 and SubStatus == "0xc000006a"
| summarize UserCount=dcount(TargetAccount), AttemptCount=count() by IpAddress, bin(TimeGenerated, 30m)
| where UserCount > 15
```

## Spray Tools (Red Team Reference)

| Tool | Platform | Command |
|------|----------|---------|
| MSOLSpray | Azure AD | `Invoke-MSOLSpray -UserList users.txt -Password "Summer2026!"` |
| SprayingToolkit | OWA/Lync | `atomizer.py owa target.com passwords.txt emails.txt` |
| Ruler | Exchange | `ruler --domain target.com brute --passwords pass.txt --users users.txt` |
| kerbrute | AD Kerberos | `kerbrute passwordspray --dc DC_IP -d target.com users.txt "Password1"` |
| o365spray | Microsoft 365 | `o365spray --spray -U users.txt -P "Winter2026!" -d target.com` |

## Account Lockout Policy

```powershell
# Check current policy
net accounts
Get-ADDefaultDomainPasswordPolicy

# Recommended settings
# Lockout threshold: 10 attempts
# Lockout duration: 30 minutes
# Reset counter: 30 minutes
# Complex passwords: Required
# Minimum length: 14 characters
```

## Key Detection Thresholds

| Metric | Threshold | Window |
|--------|-----------|--------|
| Unique users per IP | >15 | 30 min |
| Failure:user ratio | <3:1 | Per window |
| Distributed IPs per user set | >3 | 1 hour |
| Success after spray | Any | Real-time |
