T1110.003 Brute Force: Password Spraying

2 threats tracked by Spectrum Delta use this technique.

T1110.003 on MITRE ATT&CK →

• ARTEX Okta/Entra spray campaign

  Password spraying: machine-paced, provider-agnostic, role-targeted

  Okta authentication logs and Entra sign-in logs: bursty failed authentications across many users with one-second median spacing, per-burst user-agent consistency, engineer-role skew, source-IP rotation after blocking and endpoint switching after rate-limiting

  Seen in: Okta authentication logs, Entra sign-in logs

• k0t edge-device campaign

  Kerbrute password spraying against domain controllers

  DC security logs: 4771/4768 Kerberos preauth failures across many accounts from one source

  Seen in: Domain controller security logs