Which SIEM platforms have a T1110.003 detection rule?

df00tech provides T1110.003 (Password Spraying) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Password Spraying (T1110.003)?

Detecting Password Spraying requires the following data sources: Authentication: Authentication Logs, Logon Session: Logon Session Creation, Azure Active Directory Sign-in Logs, Windows Security Event Log.

What severity and confidence is the T1110.003 detection?

The T1110.003 detection is rated high severity with high confidence.

What are common false positives for T1110.003?

Common false positives for T1110.003 include: Misconfigured service accounts using stale credentials that authenticate against multiple systems simultaneously during a configuration failure event; Authorized penetration testing or red team exercises targeting multiple accounts with common passwords from a designated test IP; ADFS or federated identity proxy services whose single IP proxies authentication for all federated users — these IPs will appear as the source for all federation failures.

T1110.003 IBM QRadar · QRadar

Detect Password Spraying in IBM QRadar

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. This technique is deliberately throttled to avoid triggering per-account lockout thresholds — the defining characteristic that distinguishes spraying from brute force (T1110.001). Adversaries including APT28, APT29, HAFNIUM, Storm-0940, Chimera, and APT33 have used this technique at scale against OWA, Microsoft 365, VPN portals, SSH, RDP, SMB, and LDAP. Slow-spray variants (approximately 4 attempts per account per hour) are specifically designed to evade detection thresholds, and Kerberos-based spraying is used to avoid generating the high-visibility Event ID 4625 typically alerted on.

MITRE ATT&CK

Tactic: Credential Access
Technique: T1110 Brute Force
Sub-technique: T1110.003 Password Spraying
Canonical reference: https://attack.mitre.org/techniques/T1110/003/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(FLOOR(starttime / 1800000) * 1800000, 'YYYY-MM-dd HH:mm') AS TimeWindow,
  sourceip AS SourceIP,
  COUNT(*) AS FailureCount,
  COUNT(DISTINCT username) AS DistinctAccounts,
  DATEFORMAT(MIN(starttime), 'YYYY-MM-dd HH:mm:ss') AS FirstSeen,
  DATEFORMAT(MAX(starttime), 'YYYY-MM-dd HH:mm:ss') AS LastSeen,
  LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
  QIDNAME(qid) AS EventName
FROM events
WHERE (
  (
    LOGSOURCETYPENAME(logsourceid) IN (
      'Microsoft Windows Security Event Log',
      'Microsoft AD Security Event Log',
      'Microsoft Active Directory'
    )
    AND (
      CATEGORYNAME(category) ILIKE '%authentication%'
      OR CATEGORYNAME(subcategory) ILIKE '%logon failure%'
      OR CATEGORYNAME(subcategory) ILIKE '%invalid password%'
    )
  )
  OR CATEGORYNAME(category) = 'Authentication Failure'
  OR (
    LOGSOURCETYPENAME(logsourceid) IN ('Linux OS', 'Linux DHCP', 'SolarWinds Kiwi Syslog')
    AND CATEGORYNAME(subcategory) ILIKE '%failed password%'
  )
)
AND sourceip NOT IN ('127.0.0.1', '::1', '0.0.0.0')
AND sourceip IS NOT NULL
AND username IS NOT NULL
AND username != ''
AND LOWER(username) NOT IN ('anonymous logon', 'nt authority\\anonymous logon')
LAST 24 HOURS
GROUP BY
  FLOOR(starttime / 1800000),
  sourceip
HAVING
  COUNT(DISTINCT username) >= 10
  AND (CAST(COUNT(*) AS FLOAT) / CAST(COUNT(DISTINCT username) AS FLOAT)) <= 5.0
ORDER BY DistinctAccounts DESC

high severity high confidence

IBM QRadar AQL query detecting password spraying by grouping authentication failure events into 30-minute buckets (via epoch millisecond arithmetic: 1800000ms = 30 min) per source IP, flagging sources targeting 10 or more distinct accounts with an average failure rate of 5 or fewer per account. Covers Windows Security Event Log, Active Directory, and syslog-sourced Linux authentication failures using QRadar-normalized category and subcategory fields. The HAVING clause enforces both the spray account threshold and the brute-force exclusion ratio in a single pass.

Data Sources

Microsoft Windows Security Event Log (EventID 4625)Microsoft Active Directory / Domain ControllersLinux syslog SSH/PAM authentication failuresVPN gateway authentication logs (Cisco ASA, Palo Alto)RADIUS server authentication logs

Required Tables

events

False Positives & Tuning

Large enterprise networks where all outbound authentication traffic is sourced from a shared egress IP — during organization-wide password expiry enforcement, hundreds of users failing authentication simultaneously will all appear under one source IP and easily exceed the 10-account threshold
Automated monitoring or synthetic transaction systems that test authentication endpoints across multiple service accounts from a single monitoring host IP as part of SLA verification or health checks
Legacy application integrations using NTLM authentication that generate spurious 4625 events before successfully negotiating Kerberos, creating artifically inflated failure counts under infrastructure IPs

Download portable Sigma rule (.yml)

Other platforms for T1110.003

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Local Account Password Spray via Net Use (Windows)
Expected signal: Windows Security Event ID 4625 — one per iteration with LogonType=3, TargetUserName=each account in the list, SubStatus=0xC0000064 (unknown user) for non-existent accounts or 0xC000006A (wrong password) for existing accounts, IpAddress=127.0.0.1. SecurityEvent 4648 (Explicit Credential Logon) may also fire. With 12 accounts in the list, DistinctAccounts=12 will exceed the default threshold of 10.
Test 2Azure AD Password Spray via PowerShell OAuth Token Request
Expected signal: Azure AD SigninLogs entries (visible in Azure Portal > Azure AD > Sign-in logs within 5-15 minutes) for each request: ResultType=50126 (InvalidUserNameOrPassword) or 50057 (account disabled), IPAddress=your public egress IP, AppDisplayName='Microsoft Azure PowerShell' or 'Azure Active Directory PowerShell', UserAgent containing 'PowerShell'. With 11 accounts in the list, DistinctAccounts=11 exceeds the SprayAccountThreshold=10.
Test 3Kerberos Password Spray via Rubeus (Low-Visibility Technique)
Expected signal: Windows Security Event ID 4771 on the Domain Controller for each domain account targeted. Fields: Client Address = spray source IP, Account Name = target username, Service Name = krbtgt, Failure Code = 0x18 (KRB_AP_ERR_BAD_INTEGRITY — wrong password) or 0x6 (KDC_ERR_C_PRINCIPAL_UNKNOWN — unknown account). Event ID 4768 (TGT Request) may appear for accounts that receive AS-REQ. The /delay 2000ms and /jitter 30% simulate slow-spray behavior. Main 4625-based detection does NOT fire, demonstrating the detection gap this technique exploits.
Test 4SMB Password Spray via CrackMapExec Against Subnet
Expected signal: Windows Security Event ID 4625 on the target host for each account attempted: LogonType=3 (Network), SubStatus=0xC000006A (wrong password) for valid accounts or 0xC0000064 (unknown user) for invalid accounts, IpAddress=attacker IP, WorkstationName=blank (common CrackMapExec behavior), AuthenticationPackageName=NTLM. With 10 accounts, DistinctAccounts=10 meets the default detection threshold. EventID 7045 may appear if CrackMapExec uses service-based execution. Sysmon Event ID 3 (Network Connection) visible on attacking host.

Last updated: 2026-04-17 Research depth: deep

References (13)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1110.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Password Spraying in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1110.003

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Credential Access

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1110.003

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Credential Access

Popular Detections

Get new detections in your inbox