Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000106

AD domain with multiple failed authentication attempts via process

High
Active Directory
Initial Access
v16

Signature Identity

CTD-000106
Threat ID
16
Version
IOA-IOC
Indicator Type

Threat Description

A process failing to authenticate with multiple users might be an indication of a threat actor trying to obtain initial access or elevate their privileges by performing a Password Spraying attack against an Active Directory environment. The detection mechanism uses native events from Security Log. The event 4625 documents failed attempts to log on to the computer and Logon Type value 2 describes an interactive logon attempt.

NOTE: This threat rule includes a built-in lookback parameter set to 25 hours. Only events that occurred within this timeframe are processed by the rule.

MITRE ATT&CK: Attack Tactics

Initial Access

D3FEND: Defend Tactics

Local Account Monitoring

Remediation

  1. To reset the password of a user affected by Password Spray attack using ADUC (Active Directory Users and Computers):
    1. Run the ADUC console (dsa.msc).
    2. Search for the user account in the AD domain.
    3. Right-click on it.
    4. Select Reset password.
    5. You can search by right-clicking the domain and selecting Find, or by navigating to the user’s location in AD.
    6. In the Reset Password dialog, enter the new password and confirm it. You can also check the option to force the user to change the password at the next logon.
    7. Click OK.
  2. To eliminate easily guessed passwords, configure Microsoft Entra Password Protection. This capability includes a globally banned password list that Microsoft maintains and updates. You can also block a custom list of passwords that are relevant to your region or company. Once enabled, users won’t be able to choose a password on either of these lists, making it significantly less likely that an adversary can guess a user’s password. You can also use this feature to define how many sign-in attempts will trigger a lockout and how long the lockout will last. Learn more: Deploy on-premises Microsoft Entra Password Protection – Microsoft Entra ID | Microsoft Learn.
  3. The best way to reduce your risk of password spray is to eliminate passwords entirely. Solutions like Windows Hello or FIDO2 security keys let users sign in using biometrics and/or a physical key or device. Get started by enabling Multi-Factor Authentication (MFA) across all your accounts. MFA requires that users sign in with at least two authentication factors: something they know (like a password or PIN), something they are (such as biometrics), and/or something they have (such as a trusted device).

Frequently Asked Questions

What does AD domain with multiple failed authentication attempts via process mean?

This indicates that a process is attempting to authenticate with multiple users using the same password, which can be an indication of a Password Spraying attack. The attacker is likely trying to find a valid password by attempting it against multiple accounts.

This condition is rated high severity because it allows attackers to use the Windows Logon Process (Winlogon) to attempt interactive logons, which can lead to account compromise or privilege escalation. Specifically, an attacker gains access to the Windows Security Subsystem and can manipulate the authentication process.

Attackers can use a Password Spraying attack to attempt to log on interactively using the Windows Logon Process (Winlogon), which allows them to gather information about accounts and group memberships that support planning future malicious operations. This access also enables attackers to persist in the system, making it harder to detect.

Cayosoft Guardian detects this condition by monitoring native events from the Security Log, specifically event 4625 and Logon Type value 2. This allows Guardian to identify potential Password Spraying attacks in real-time.

Cayosoft Guardian helps reduce the risk by alerting administrators to potential Password Spraying attacks, allowing teams to take swift action to mitigate the threat, such as resetting passwords or implementing Multi-Factor Authentication (MFA) across all accounts. This provides visibility and supports investigation into the attack.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection Password Spraying
Attack Tactics
Initial Access
Defend Tactics
Local Account Monitoring
Indicator Types
IOA IOC
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical