aol.pm

Password Spraying

Subtechnique · ATTACK:enterprise:T1110.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1110.003",
  "title": "Password Spraying",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1110/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--692074ae-bb62-4a5e-a735-02cb6bde458c",
  "external_id": "T1110.003",
  "domain": "enterprise",
  "created": "2020-02-11T18:39:25.122Z",
  "modified": "2025-10-24T17:48:53.996Z",
  "version": "1.8",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Trimarc Detecting Password Spraying",
      "url": "https://www.trimarcsecurity.com/single-post/2018/05/06/Trimarc-Research-Detecting-Password-Spraying-with-Security-Event-Auditing"
    },
    {
      "source_name": "Microsoft Storm-0940",
      "url": "https://www.microsoft.com/en-us/security/blog/2024/10/31/chinese-threat-actor-storm-0940-uses-credentials-from-password-spray-attacks-from-a-covert-network/"
    },
    {
      "source_name": "BlackHillsInfosec Password Spraying",
      "url": "http://www.blackhillsinfosec.com/?p=4645"
    },
    {
      "source_name": "US-CERT TA18-068A 2018",
      "url": "https://www.us-cert.gov/ncas/alerts/TA18-086A"
    }
  ]
}

Explicit source assertions (23)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0502f3b2-8ec0-444e-830f-d77e703544a8

Microsoft Silk Typhoon MAR 2025

ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b8b803a-69e3-4da4-bed6-a28de4c964da

Secure List Bad Rabbit

ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11027c06-b55a-4b0f-957c-f9f67daf21a7

CME Github September 2018

ATTACK:enterprise:S0362 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cf57140-fe45-4c26-8946-071252ae8276

Anomali Linux Rabbit 2018

ATTACK:enterprise:C0051 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--389ad3ac-7d28-4cb5-96fe-c99ace701e55

Nearest Neighbor Volexity

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43c887fb-4a26-4712-a907-adf1a4c9286f

AI-Mexico-Govt-Breach

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64201f56-d678-4ed2-b759-c78bf9e4d82a

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65df5db9-2a69-43b6-a45d-e8cd5dd24104

Unit42 Agrius 2023

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67e281a2-0bbc-4a6e-a9a7-3f22649f9d14

CISA GRU29155 2024

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c4b2975-6cad-4a10-8006-1e2e973a8a8b

MSTIC Nobelium Oct 2021 · MSRC Nobelium June 2021 · NCSC et al APT29 2024

ATTACK:enterprise:C0055 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71960517-1700-47ed-8abe-85c384458630

Microsoft Storm-0940

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76ef2eb1-a94c-4dd8-be1e-ccb63d577d9e

SecureWorks August 2019

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83ba5b2c-b3fd-4558-a3f8-cef4c31e02bd

Novetta Blockbuster RATs · Novetta Blockbuster

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b5691c7-1815-4d76-a7dd-dfd827043bb9

FireEye APT33 Guardrail · Microsoft Holmium June 2020

ATTACK:enterprise:G0122 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93edbfc7-c1be-4c2c-aa2c-9b15f53f6528

DOJ Iran Indictments March 2018

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8519c68-ab22-4254-bd22-c76b71de1b9e

NCC Group Chimera January 2021

ATTACK:enterprise:S0413 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b85cff83-6468-4c63-9b25-4ac75fcb0e10

GitHub MailSniper

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c215cce3-a2f5-4534-937c-b15d7be4588c

NIST 800-63-3

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c47b3759-8c59-45f7-8ae1-66b49a5359f8

Symantec Leafminer July 2018

ATTACK:enterprise:M1036 → mitigates → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cff34686-cbdf-4e0b-8108-c2deaf8855a7

Microsoft Common Conditional Access Policies · Okta Block Anonymizing Services

ATTACK:enterprise:T1110.003 → subtechnique-of → ATTACK:enterprise:T1110

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0934ba2-a4dc-4e1a-8065-84b142ecb01c

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6958d59-7b54-407c-8bd9-00891c580acc

Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020 · Microsoft Targeting Elections September 2020 · Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1110.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe10ef02-3c90-4b9b-93e0-b9fe6372c4d0

Mandiant_UNC1549TTPsTools_Nov2025

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.