Brute force versus password spraying: writing detections that tell them apart

Two shapes in the data

Brute force targets one or a few accounts with many passwords: high attempts per user, few users per source. Password spraying tries one or two common passwords against many accounts: few attempts per user, many users per source. Credential stuffing replays leaked username-password pairs: many users, about one attempt each, often from many IPs.

Lockout policies stop brute force against a single account but do little against spraying, which stays under the threshold for each user.

Classify with two numbers

For each source over a window, compute total failures, distinct users, and failures per user. The ratio separates the shapes cleanly.

index=auth action=failure earliest=-1h
| stats count as fails dc(user) as users by src_ip
| eval per_user = round(fails / users, 1)
| eval shape = case(users >= 15 AND per_user <= 3, "spray", users <= 3 AND fails >= 30, "brute_force", true(), "other")
| where shape != "other"
| sort - fails

Lab: generate and classify

Create a CSV with synthetic authentication events: one IP trying 200 passwords against one user, another trying one password against 80 users, and normal background failures from typos. Load it into your SIEM lab or analyze it with Python or KQL datatable, run the classifier, and adjust thresholds until the typos are not flagged. Then add a column for whether each flagged source had any success.

Response differs

For brute force, confirm the account is protected by lockout and MFA and block the source. For spraying, check for any success from the source, force password changes for those accounts, look at banned password lists, and consider Smart Lockout or IP reputation controls. In both cases, MFA is the control that makes a correct password insufficient.