Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000107

AD domain with multiple failed remote authentication attempts

High
Active Directory
Initial Access
v12

Signature Identity

CTD-000107
Threat ID
12
Version
IOA-IOC
Indicator Type

Threat Description

If one source endpoint tries to authenticate with different unique user accounts against a single domain controller, it might be a threat actor performing a Password Spraying attack against an Active Directory environment. The detection mechanism uses native events from Security Log. The event 4625 documents failed attempts to log on to the computer and Logon Type value 3 describes a remote authentication attempt.

NOTE: This threat rule includes a built-in lookback parameter set to 25 hours. Only events that occurred within this timeframe are processed by the rule.

MITRE ATT&CK: Attack Tactics

Initial Access

D3FEND: Defend Tactics

Local Account Monitoring

Remediation

  1. To reset the password of a user affected by Password Spray attack using ADUC (Active Directory Users and Computers):
    1. Run the ADUC console (dsa.msc).
    2. Search for the user account in the AD domain.
    3. Right-click on it.
    4. Select Reset password.
    5. You can search by right-clicking the domain and selecting Find, or by navigating to the user’s location in AD.
    6. In the Reset Password dialog, enter the new password and confirm it. You can also check the option to force the user to change the password at the next logon.
    7. Click OK.
  2. To eliminate easily guessed passwords, configure Microsoft Entra Password Protection. This capability includes a globally banned password list that Microsoft maintains and updates. You can also block a custom list of passwords that are relevant to your region or company. Once enabled, users won’t be able to choose a password on either of these lists, making it significantly less likely that an adversary can guess a user’s password. You can also use this feature to define how many sign-in attempts will trigger a lockout and how long the lockout will last. Learn more: Deploy on-premises Microsoft Entra Password Protection – Microsoft Entra ID | Microsoft Learn.
  3. The best way to reduce your risk of password spray is to eliminate passwords entirely. Solutions like Windows Hello or FIDO2 security keys let users sign in using biometrics and/or a physical key or device. Get started by enabling Mult-Factor Authentication (MFA) across all your accounts. MFA requires that users sign in with at least two authentication factors: something they know (like a password or PIN), something they are (such as biometrics), and/or something they have (such as a trusted device).

Frequently Asked Questions

What does AD domain with multiple failed remote authentication attempts mean?

This condition indicates that one source endpoint is attempting to authenticate with different unique user accounts against a single domain controller, which may be a legitimate user or an attacker performing a Password Spraying attack.

This condition enables a potential compromise of the domain's password policies, allowing attackers to use Password Spraying to attempt to log in to the Active Directory environment. The attacker gains access to the domain and can perform malicious operations.

Attackers can use the Password Spraying technique to attempt to log in to the Active Directory environment using different user accounts, which involves sending a large number of login requests with identical passwords to multiple user accounts. This allows them to potentially gain access to the domain and perform malicious operations.

Cayosoft Guardian detects AD domain with multiple failed remote authentication attempts by monitoring native events from Security Log, specifically event 4625 documenting failed attempts to log on to the computer and Logon Type value 3 describing a remote authentication attempt.

Cayosoft Guardian helps reduce the risk by providing visibility into potential Password Spraying attacks and alerting administrators to take action, such as resetting passwords and configuring Microsoft Entra Password Protection. This supports investigation and response efforts.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection Kerberos Password Spraying
Attack Tactics
Initial Access
Defend Tactics
Local Account Monitoring
Indicator Types
IOA IOC
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical