Password spraying
One or few common passwords tried across many accounts to dodge lockout
categoryIdentity, authentication and credential attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab
Example: Midnight Blizzard; >97% of identity attacks (MDDR)
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1110.003 -Tool atomic -RunId run-2026-10-20-007 -Command 'Invoke-AtomicTest T1110.003 -TestGuids f14d956a-5b6e-4a93-847f-0c415142f07d -TimeoutSeconds 120'What our lab measured
partially detected windows · 2026-10-20 · detected in 0s
What it looked like in telemetry
| Log source | What it means |
|---|---|
| Sysmon · EID 1 | Access token manipulation: SYSTEM-integrity process created by a non-service parent |
| Sysmon · EID 1 | Powershell process spawned powershell instance |
| Sysmon · EID 11 | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe created a new scripting file under Windows Temp or User data folder |
| Sysmon · EID 11 | Executable file dropped in folder commonly used by malware |
| PowerShell · EID 4104 | Powershell script querying system environment variables |
| PowerShell · EID 4104 | Powershell script recursively collected files from a filesystem search |
| PowerShell · EID 4104 | Powershell script searching filesystem |
| PowerShell · EID 4104 | Powershell script used "Invoke-command" cmdlet to execute sub script |
| … and 6 more event type(s) | |
Detection that fired
- ✓ Wazuh
100230(level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent
Plus 20 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~119255 incidental alerts/hour — tune against this.
Classification
30 values: 9 reviewed, 2 lab-measured, 13 imported, 6 derived. What do these mean?
Exploitability
| Attack vector | Credential attacks |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Commoditized |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows |
| Environment | CloudOn-premises |
| Target asset class | Identity |
| Kill-chain phase (tactic) | Credential Access |
Detection & telemetry
| Detectability (measured in our lab) | Medium |
|---|---|
| Detectability (public detection content) | High |
| Noise level | High |
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | User Account Authentication |
Detection & response
Mitigated by 30
- M1027 attack-mitigation
- M1032 attack-mitigation
- M1036 attack-mitigation
D3-AEMd3fendD3-ANAAd3fendD3-ANCId3fendD3-APCAd3fendD3-CAAd3fendD3-CCSAd3fendD3-CDPd3fendD3-CHd3fendD3-CRd3fendD3-CROd3fendD3-CSPPd3fendD3-CTSd3fendD3-DUCd3fendD3-MFAd3fendD3-NTCDd3fendD3-NTFd3fendD3-NTSAd3fendD3-OPMd3fendD3-OTPd3fendD3-PHDURAd3fendD3-PMADd3fendD3-PRd3fendD3-PWAd3fendD3-RICd3fendD3-RTSDd3fendD3-SPPd3fendD3-UGLPAd3fend
Detected by 3
- DET0487 attack-detection-strategy
100440wazuh100441wazuh
Tested by 9
263ae743-515f-4786-ac7d-41ef3a0d4b2batomic5ccf4bbd-7bf6-43fc-83ac-d9e38aff1d82atomic90bc2e54-6c84-47a5-9439-0a2a92b4b175atomic9c10d16b-20b1-403a-8e67-50ef7117ed4eatomica8aa2d3e-1c52-4016-bc73-0f8854cfa80aatomicb15bc9a5-a4f3-4879-9304-ea0011ace63aatomicc6f25ec3-6475-47a9-b75d-09ac593c5ecbatomicf14d956a-5b6e-4a93-847f-0c415142f07datomicf3a10056-0160-4785-8744-d9bd7c12dc39atomic
Attack relationships
- Parent: Broken authentication (API)
- Parent: WPS PIN brute force
Lab findings
Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.
| Run | Outcome | Tool | Platform | Ran at |
|---|---|---|---|---|
run-2026-10-20-007 | partially-detected | atomic | windows | 2026-10-20 |
run-2026-11-02-017 | detected | atomic | windows | 2026-11-02 |
run-2026-10-20-007— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=9). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1110.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=3147 max_level=15 dwell_s=90run-2026-11-02-017— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=9). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1110.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=59 max_level=15 dwell_s=90
Framework references
- Primary source: https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
- attack: T1110.003 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 316 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 17 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0003 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-007 (partially-detected) for T1110.003: no alert matched the expected technique
- ev-0004 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-017 (detected): Wazuh rule(s) 100440, 100441 fired on T1110.003 within the detonation window
PowerShell LDAP bind loop over a credential list (LdapConnection.Bind per password) -- password guessing / spraying -- T1110.001