Key takeaway
Monitor repeated failures against one account and low-volume attempts spread across many accounts. Do not log passwords. Combine MFA, suitable rate limits and protected recovery with a response plan.
Distinguish the attack methods
Targeted password guessing (brute force) tests many password candidates against an account; dictionary and hybrid variants start with likely passwords and combinations. Password spraying tests one or a few common passwords across many accounts, usually with few attempts per account. Credential stuffing reuses username and password pairs exposed in earlier breaches on other services. These methods differ and may produce different signals.
Password guessing · brute force
Many guesses against one account; failed sign-ins may rise quickly.
Password spraying across accounts
One likely password is tried against many accounts; per-account thresholds may miss the pattern.
Credential stuffing
Leaked sign-in pairs are reused on other services; unique passwords and MFA reduce the risk.
Look for patterns in sign-in logs
Do not rely only on counts from one IP: distributed attempts may come through many addresses, proxies or a botnet. Correlate failed sign-ins across accounts, attempts from new or unexpected locations, lockouts, denied MFA prompts and a successful sign-in after failures. Account for normal work patterns and VPN use; location alone does not prove compromise.
Layer sign-in defenses
Use long unique passwords, a password manager and phishing-resistant MFA. Apply rate limits and adaptive delays at sign-in points, while accounting for the risk that hard account lockouts can be abused for denial of service. Add CAPTCHA or bot controls where appropriate, but do not rely on them alone. Teach users to deny and report unexpected MFA prompts.
Recover a suspicious account safely
If compromise is suspected, change the password from a trusted, clean device; revoke active sessions and tokens, and review recovery email and phone, forwarding rules, app permissions and MFA enrollment. Temporarily restrict the account under the approved incident process, preserve logs and check whether the same password was used on other affected accounts. Changing a password does not clean a compromised device or remove ongoing malware.
Detect privilege escalation and cross-account access
Initial access, privilege escalation and lateral movement are distinct objectives and do not always follow a fixed order. An attacker may compromise an already privileged account or gain additional rights after reaching another system.
Vertical escalation
A standard account gains administrator or root rights. Patch operating systems and review file, directory and task permissions for services that run with elevated privileges.
Horizontal access-control failure
A user reaches another user’s order, document or profile without changing roles. The server must check object ownership and authorization on each request.
Log and endpoint evidence
Investigate unexpected administrator-group or ACL changes, new services and scheduled tasks, disabled security agents and interference with privileged processes. Compare SIEM events and EDR process context with approved changes.