Security teams should watch for repeated authentication attempts spread across time, users, or source addresses rather than only bursty login failures. Low-and-slow spraying is designed to evade threshold-based alerts, so detections need wider time windows, correlation across identities, and enrichment from MFA status, application access, and unusual login patterns to surface early compromise before privilege escalation occurs.
Why low-and-slow spraying is hard to see
Low-and-slow password spraying succeeds because it looks like ordinary authentication noise when teams only count failures in short windows. The attack spreads attempts across many accounts, times, and source addresses so it avoids simple lockout logic and burst-based rules. Detection has to shift from event counting to pattern recognition across identities, applications, and time.
That means the useful signal is often not a single failed login, but a repeatable sequence: a small number of failures, the same source or ASN family, reused target sets, and a later success on an account that should not have been interesting in the first place. Detections improve when teams correlate across sources and normalize for login volume by tenant, app, or user population.
Another reason it is missed is that spray activity often happens before the attacker reaches the most sensitive accounts. If your telemetry only highlights privileged-account failures, you are already late. Early warning comes from weak but persistent pressure on ordinary accounts, especially when the same pattern touches accounts with MFA gaps, stale access paths, or unusual application access history. For broader identity and access hygiene, see Ultimate Guide to NHIs and Top 10 NHI Issues, which both reinforce visibility, lifecycle, and privilege control as detection enablers.
What good detection logic looks like
Practical detections should use wider windows than the attacker’s cadence, then correlate by user set, source reputation, application, and outcome. A single source failing against many accounts over hours can be more suspicious than a noisy burst over minutes. Likewise, a distributed set of sources hitting the same small account group should still stand out if the targets share a common app, region, or authentication path.
Enrichment matters because not all failed logins are equal. Failed attempts against accounts without MFA, accounts with legacy protocol access, or accounts that recently changed geography or device posture deserve higher weight than routine user error. If your identity stack exposes signals such as impossible travel, new device, atypical app usage, or repeated failures followed by a first-time success, feed those into correlation rather than treating them as separate alerts.
Teams should also tune for the attacker’s selection strategy. Spray campaigns often start with broad username lists, then narrow to accounts that accept the guessed password or show weaker controls. Detections that look for repeated failures across many users, followed by a small cluster of successes, usually surface earlier than rules that wait for one account to fail too many times. For operational context on account compromise patterns, The 52 NHI breaches Report and SonicWall VPN Mass Breach via Stolen Credentials show how credential abuse scales once access is gained.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM — Security Continuous Monitoring | Cross-account auth anomaly detection depends on ongoing monitoring. |
| PR.AA — Identity Management, Authentication, and Access Control | Spraying targets authentication and access enforcement weaknesses. | |
| DE.AE — Anomalies and Events | Low-and-slow spraying is an anomaly pattern spread across users and time. | |
| Recommendation — Correlate authentication telemetry across identities and time to surface spray patterns early. Strengthen authentication signals and access enforcement so repeated guesses stand out sooner. Tune detections for distributed login anomalies instead of only burst failure thresholds. | ||
| CIS Controls v8 | 5.1 — Account Inventory and Control | Spray detection improves when accounts and access paths are well inventoried. |
| 6.3 — Access Management | Spraying becomes visible sooner when access rules and identity signals are enforced consistently. | |
| 8.2 — Audit Log Management | Detection requires durable logs for failed and successful authentication activity. | |
| Recommendation — Maintain accurate account inventory so authentication anomalies can be mapped to the right identities. Apply consistent access controls and review authentication results for abnormal reuse patterns. Retain and centralize authentication logs so cross-identity spray correlation is possible. | ||
| MITRE ATT&CK | T1110.003 — Password Spraying | The question is specifically about detecting this adversary technique. |
| T1078 — Valid Accounts | Spraying often ends in valid account access before privilege escalation. | |
| Recommendation — Map detections to password spraying so analysts can hunt for distributed guess attempts. Track successful logins after spray-like failures to catch account abuse before escalation. | ||
| OWASP Non-Human Identity Top 10 | NHI-09 — NHI Monitoring and Detection | Repeated auth abuse against service and machine identities follows the same detection problem. |
| Recommendation — Extend anomaly detection to repeated authentication abuse across identity populations. | ||
Practitioner Guidance
What to prioritise: Tune detections around identity-level patterns, not per-account thresholds alone. The first useful question is whether the same source, user set, app, or password guess pattern repeats across time and reaches accounts that should not share the same access profile.
What to verify: Confirm your telemetry includes successful and failed authentications, MFA result codes, source IP or ASN, device context, and the application being accessed. Without those fields, low-and-slow spraying often looks like routine noise until a privileged account is touched.
What good looks like: Analysts can see a slow campaign before privilege escalation, explain why the targets are related, and separate genuine user mistakes from cross-identity correlation. When the pattern is real, the response should move from alert triage to password reset, token review, and source containment.
Practitioner takeaway: The best detections do not wait for an account to fail repeatedly, they identify coordinated pressure across many accounts early enough that privileged access never becomes the first clear signal.
Related resources from NHI Mgmt Group
- How should security teams detect LDAP reconnaissance before attackers map privileged accounts?
- How should security teams detect low and slow API attacks before they reach the exploitation phase?
- How should security teams detect anomalous access to password manager accounts before a compromise spreads?
- How should security teams detect password spraying in Active Directory?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
