Patch, the HackerManiacs host: a cartoon young woman with a raspberry-pink bob, a violet hoodie and headphones around her neck, gesturing as she explains

Hey, I’m Patch. Today we read a log, not a lock. Everything here happens in a legal practice lab on HackerDNA, and the company in it is fictional. Only test systems you own or have written permission to test.

This Daily Hack is a short blue-team puzzle: a company’s single sign-on (SSO) logged a strange minute, and you have to work out which account the attacker actually got into. It takes a few minutes. The skill behind it, reading authentication logs by source instead of by account, is one you will use for years.

I won’t give you the answer here. You’ll find it yourself in the challenge. What you get from me is the why.

What a password spray is

Picture an office building with a hundred doors and one stolen key. A burglar who tries that key a hundred times on the same door makes a lot of noise, and the door jams after the fifth try. A smarter burglar walks down the corridor and tries the key once in every door. Most doors stay shut. One of them opens.

That is the whole idea:

Brute force is deep: many passwords against one account. It quickly trips account lockouts.
Password spraying is wide: one likely password against many accounts, one attempt each. No single account sees more than one failure, so per-account lockouts never fire.

MITRE ATT&CK, the public catalogue of attacker techniques, lists this as Password Spraying (T1110.003) and describes exactly that trade: spread the guesses out to avoid lockouts.

Diagram comparing brute force and password spraying. Brute force: one source sends five guesses at one account, which gets locked. Password spray: one source tries one password once against eight accounts; seven fail and one succeeds. — Same attacker, different shape. Brute force is a tall stack on one name; a spray is a flat line across many.

Why it matters

Sprays work because people reuse passwords and pick predictable ones. If a password leaked somewhere else, or follows an obvious pattern, the odds that someone in a large organisation uses it are not small. The attacker does not need your account. They need anyone’s.

It is also quiet. Each account shows a single failed sign-in, which looks like a typo. If your monitoring only asks “has this account failed too often?”, the answer is always no. That is the blind spot this challenge trains you to see.

Approaching the challenge

You get a SIEM view of the sign-in events. SIEM stands for Security Information and Event Management: a tool that collects logs in one place so you can search and filter them. Here is how I’d think about it, without the spoilers.

1. Change the question you ask the log

Don’t scroll looking for “lots of red on one user”. That is the brute-force picture, and it is not what happened here. Ask instead: which source address touched many different usernames in a short window? Filter by the source column, not the user column.

Fictional SIEM view filtered to one source address, 192.0.2.44. Ten sign-in attempts in seventeen seconds, each against a different username such as alice, bob and carol. Nine fail; one succeeds and its username is redacted. — An invented example, not the challenge data. Once you filter by source, the spray reads like a list.

2. Inside that burst, look for the odd one out

Once one source is isolated, the pattern should look like the illustration: one attempt per name, seconds apart, almost all failing. Almost. A spray is only interesting to an attacker when one door opens. Narrow the filtered view to the result you care about.

3. Watch for the decoy

Logs are full of normal humans. Someone mistypes their password once, then gets it right from their own address. That is a failed-then-succeeded pair, but it is not a spray: one user, one source, a retry. The challenge includes something like this on purpose. Ask yourself whether the success belongs to the burst or to an ordinary retry.

4. Answer the question that was asked

The challenge asks which account let the attacker in. Not the attacker’s address, not the time. The compromised account is answer, and you’ll find it yourself in the challenge.

Good, that’s the method. Notice that you never needed a tool fancier than a filter. The hard part was choosing the right column.

How defenders catch and stop it

This is the part that matters after the challenge is solved.

Detect breadth, not just depth

Count failures per source as well as per account. A rule like “one address attempted more than N distinct usernames within a few minutes” catches the spray shape directly. Tune N to your environment: a shared office proxy or a VPN gateway may legitimately carry many users, so know which sources those are.

The same ten failed sign-ins counted two ways. Per account, every account has one failure, below a lockout threshold of five. Per source, one address touched ten distinct usernames in seventeen seconds, crossing an alert threshold of five. — Identical events. Only the grouping changed, and with it, whether anyone gets paged.

Make a correct password not enough

Multi-factor authentication (MFA) means a matched password alone does not grant access. A spray that “succeeds” against an MFA-protected account usually ends at the second factor. It is the single biggest reducer of this risk.

Remove the guessable passwords

Sprays depend on common or previously leaked passwords. NIST’s digital identity guidelines, SP 800-63B, require checking new passwords against a blocklist of commonly used, expected or compromised values. If the sprayed password can’t be set in the first place, the spray has nothing to land on.

Treat “success after a spray” as an incident

If an account signs in successfully from an address that just failed against many others, that success is suspicious by definition. Step up authentication, force a password reset, and review what the session did. The OWASP Authentication Cheat Sheet has more on throttling and account-protection patterns.

Rate limit per source, carefully

Throttling sign-ins per source slows a spray down. It won’t stop an attacker who rotates addresses, which is why it is a layer and not the whole answer. Combine it with the detections above.

Takeaways

Brute force is deep, a spray is wide. Look for one source, many usernames, one try each.
Per-account lockouts don’t see sprays. Per-source counting does.
A single failed-then-succeeded pair from a user’s own address is usually just a typo, not an attack.
MFA and banning breached passwords take away the easy win; detection tells you someone tried.
Read the question twice. Here it asks for the account, not the attacker.

If you want to try this one yourself, the challenge is on HackerDNA as a Daily Hack. Today’s Daily Hack is free; older ones live in the archive, which is part of the Pro plan. You can open HackerDNA here (affiliate link).

That’s the lab. Not the answer: the understanding. Stay curious. Stay authorized.