Password spraying
Password spraying tries one password or a small set of commonly used passwords across many accounts to find credentials that work.
The pattern spans accounts
Repeated failures against one person may stand out. Spraying distributes attempts across accounts, so looking only at each person’s failure count can miss the wider pattern. MITRE describes spraying against both internal services and externally accessible applications.
Unlike credential stuffing, the attacker does not need a stolen username and password pair for every target. A predictable password shared by several people can be enough to create exposure.
Password policy is only part of the defense
Blocking commonly used and easily guessed passwords reduces the pool of useful guesses. Microsoft Entra Password Protection, for example, checks proposed password changes and resets against banned-password lists. Existing passwords are not rechecked simply because the banned list changes.
MFA adds a separate requirement to a password-based sign-in. Monitoring still needs to examine activity across accounts and services, rather than assuming a quiet individual account means there is no campaign.
Start an investigation by grouping attempts across the affected accounts and services. Then look for successful sign-ins within that activity; the sign-in evidence guide explains how to interpret them.