Password Spraying

Password spraying is an adversary credential-access technique in which one or a small set of commonly used passwords is tested across many accounts, rather than many guesses against one account. The horizontal pattern can reduce per-account failure signals, but does not guarantee avoidance of lockout or detection. Authentication evidence is protocol-specific: Windows Event 4625 is logged on the computer where the logon attempt was made; Event 4771 records a failed Kerberos TGT request only on a domain controller and is not generated for accounts configured without Kerberos preauthentication; Event 4776 records NTLM credential validation on the authoritative system and includes both successful and unsuccessful attempts. Interpret evidence and lockout effects in light of the actual authentication path, account configuration, policy, and log-collection scope.