Password spraying detection in Active Directory: what teams miss

At a glance

What this is: This is a Semperis analysis of how password spraying in Active Directory avoids obvious lockout triggers and why timing, Kerberos pre-authentication, and password policy enforcement matter.

Why it matters: IAM and identity teams need to treat password spraying as a detection and policy problem, not just a failed-login problem, because weak signal handling leaves AD accounts exposed.

Context

Password spraying is a low-and-slow credential attack against Active Directory that tests a few common passwords across many accounts instead of hammering one account until it locks. That pattern matters because standard lockout logic is designed for repeated guesses against a single identity, not distributed guesses across an entire directory.

In Active Directory, minimal access can still be enough to enumerate accounts and generate authentication attempts that blend into normal traffic. For identity teams, the gap is not only detection fidelity but also the assumption that failed logons will always present a clean, countable signal.

The article shows that timing and protocol choice both shape what defenders can see. Once attackers move from noisy failures to spaced-out attempts or Kerberos pre-authentication, the monitoring model has to become more identity-aware rather than purely threshold-based.

Key questions

Q: What breaks when password spraying is not detected early in Windows environments?

A: A single successful spray can convert many weak attempts into one valid session, and that session often becomes the foothold for privilege escalation, remote tooling, and lateral movement. The practical failure is not just authentication noise. It is the loss of time, because defenders no longer see one attack, they see a domain intrusion already in progress.

Q: Why do Kerberos pre-authentication failures matter for password spraying detection?

A: They matter because the attack can move away from standard failed logon events and into a different log signal. If defenders do not monitor Kerberos pre-authentication failures, especially Event ID 4771 and 0x18, they lose visibility into a common stealth path for credential guessing.

Q: How should security teams detect password spray attacks without overwhelming analysts with false positives?

A: Security teams should combine authentication event analysis with baseline-aware detection that looks for repeated, distributed login failures across multiple accounts and systems. Good detection should correlate timing, source behavior, and account targeting patterns, then elevate only activity that matches known attack logic. The goal is to separate signal from noise so analysts can act on credible threat patterns quickly.

Q: What breaks when organisations rely only on account lockout and threat detection to stop password spraying?

A: Account lockout and detection alone leave a timing gap that attackers can exploit. AI-assisted spraying can pace attempts just under lockout thresholds, rotate infrastructure, and spread activity across accounts. By the time an alert fires, the password has already been tested. That means the control fails at the point of credential validation, where prevention is most effective.

Technical breakdown

Why password spraying evades account lockout logic

Password spraying succeeds because it distributes attempts across many accounts, staying below the per-account thresholds that trigger lockout controls. In Active Directory, that is especially useful because a user or low-privilege principal can query directory objects and generate broad authentication traffic without needing elevated access. The attack is not brute force in the classic sense. It is an authentication-distribution problem that exploits the mismatch between lockout rules and attacker workflow. Practical monitoring has to look for breadth across identities, not just depth against one account.

Practical implication: monitor failed authentication patterns across account populations, not only per-account failure counts.

How Kerberos pre-authentication changes the log signal

Kerberos pre-authentication makes detection harder because failed guesses do not always appear as standard logon-failure events in Security logs. Instead, defenders may see Kerberos pre-authentication failures, often identified by Event ID 4771 and the 0x18 result that indicates an incorrect password. That changes the analyst workflow: the question is no longer whether a logon failed, but whether the failure pattern reflects deliberate password testing. If teams only alert on generic failed logon events, they miss an important slice of password spraying activity.

Practical implication: include Kerberos pre-authentication failures in detection logic and alert tuning.

Why randomized delays defeat simple pattern matching

Randomized delays reduce the visual clustering that makes attack traffic easy to spot. Instead of a burst of failures over a short window, attempts arrive at irregular intervals that resemble ordinary user activity. This matters because many detections are built on rhythm, not identity behaviour. When the attacker controls timing, the signal becomes statistical rather than obvious. That is why response teams need anomaly detection, baselines, and correlation across accounts, hosts, and event types rather than rules that only fire on obvious bursts.

Practical implication: build detections that correlate timing irregularities with multi-account failure patterns.

Threat narrative

Attacker objective: The attacker wants a valid Active Directory login on one or more accounts without triggering lockout or obvious failed-login alarms.

1. Entry occurs through low-privilege directory access and account enumeration in Active Directory, which gives the attacker enough visibility to start distributed password guesses.
2. Credential access is attempted by testing common or weak passwords across many accounts, while delaying attempts or using Kerberos pre-authentication to reduce obvious log signatures.
3. Impact follows when one or more accounts accept the guessed password, creating unauthorized access that can be used for further identity abuse or follow-on compromise.

Breaches seen in the wild

• Storm-0501 hybrid cloud attacks 2024: Ransomware affiliate Storm-0501 stole Entra Connect Sync credentials to move from on-prem AD to Entra ID, then forged tokens via a rogue federated domain.
• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Active Directory password spraying is a detection design problem, not a simple authentication failure problem: the attack works because most monitoring still assumes repeated guesses against one account. That assumption breaks when guesses are spread across many identities and time windows. Practitioners should treat breadth, timing, and event type as first-class detection inputs, not edge cases.

Kerberos pre-authentication shifts the observable failure mode, not the underlying attack: the attacker still guesses credentials, but the log trail changes from standard failed logons to pre-authentication failures such as Event ID 4771. That means a mature programme must monitor the authentication protocol path, not only the final success or failure outcome. The practical conclusion is that event taxonomy matters as much as volume.

Randomized delays expose a broader governance gap in identity monitoring: many control sets are tuned to bursts, thresholds, and predictable retry cadence. Password spraying shows that those assumptions can be gamed with low-and-slow sequencing, so detection must align to attacker behaviour instead of user behaviour alone. The field needs directory monitoring that understands distributed identity abuse.

Credential guessability is the underlying control debt: if weak or reused passwords remain admissible, detection is forced to carry more of the security burden than it should. Enforcing stronger password policy and blocking easily guessed passwords reduces the attack surface before telemetry has to compensate. That is the operational lesson for identity programmes: prevention and detection must be designed together.

Password spraying in Active Directory is where identity hygiene and monitoring meet: the same environment that allows broad account reachability also gives defenders rich logs, but only if they interpret them correctly. The practitioner takeaway is to align password policy, event collection, and anomaly logic around distributed authentication abuse, not just repeated lockout events.

What this signals

Password spraying is a control-gap test for Active Directory: if your detections only understand repeated failures against a single account, the attacker has already chosen the path of least resistance. The programme question is whether your monitoring sees distributed identity abuse as one campaign or as isolated noise.

Semperis' analysis underscores a practical truth for IAM teams: authentication telemetry only helps when it is interpreted through the protocol path and the attack cadence. In other words, the control is not missing logs, it is missing the right logic.

For practitioners

• Harden password policy enforcement Use default domain policy or fine-grained password policies to reduce acceptance of weak passwords across Active Directory accounts. Make the policy explicit, enforceable, and consistent across user populations so spraying has fewer viable targets.
• Expand detection beyond standard failed logons Include Kerberos pre-authentication failures, especially Event ID 4771 with 0x18, in your alerting and hunting logic. Teams that only watch generic logon failures will miss the stealthier version of the attack.
• Correlate timing across multiple accounts Look for distributed failures that occur at irregular intervals across many users, rather than only bursts against a single account. Build correlation that ties together low-frequency attempts, account breadth, and source behaviour.
• Block guessable passwords before they reach production Use password protection controls that prevent users from setting passwords that are easily guessed or known to be compromised. That lowers the number of accounts an attacker can target successfully even when monitoring is noisy.
• Tune monitoring for Active Directory attack patterns Baseline normal authentication behaviour, then alert on multi-account failure spread, unusual cadence, and protocol-specific anomalies. Treat these as identity signals rather than generic infrastructure noise.

Key takeaways

• Password spraying exploits the gap between per-account lockout rules and distributed credential guessing across many identities.
• Kerberos pre-authentication and randomized timing make the attack quieter without changing the underlying objective of finding a valid login.
• Teams reduce exposure when they pair stronger password controls with detections that follow account breadth, cadence, and protocol-specific failure signals.

Key terms

• Password Spraying: A guessing technique that uses a small set of common passwords against many accounts to avoid lockouts and detection. It is effective when organisations do not reject common passwords, do not monitor patterns across identities, or allow too much standing access.
• Kerberos Pre-authentication: Kerberos pre-authentication is an early authentication step used by Active Directory to validate a login attempt before issuing a ticket. Failed attempts can produce distinct telemetry such as Event 4771, which defenders should monitor alongside standard bad-password signals.
• Account Lockout Threshold: An account lockout threshold is the number of failed authentication attempts that triggers temporary or permanent account lockout. It is useful against repeated guessing on one account, but by itself it is a weak defense against distributed attacks that spread attempts across many identities.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.