Performing password spray attacks
A different approach to get some valid credentials is by attempting to authenticate and explore if credentials are valid. This, of course, is noisy, but surprisingly it is frequently not detected.
These are a set of common protocols that an adversary might password spray against:
- LDAP
- RDP, WinRM, and SSH
- WMI/SMB
- Database systems
- Web applications
Most organizations also expose web applications that authenticate users. Those can be useful for password spraying too.
Performing password spraying on external endpoints might allow an adversary to identify accounts with weak passwords that are not enrolled in MFA. After successfully guessing the password, they can either directly log in or enroll the compromised account themselves for MFA. Subsequently, an adversary might be able to fully gain access to corporate infrastructure. This is a common tactic that has to be tested for and mitigated for your organization. Passwords...
