25. 06. 2026
Blue Team, Log-SIEM, SEC4U, Threat Intelligence
The View from the SOC
From inside the SOC, authentication traffic never really stops. Most of it is ordinary business: people signing in, services renewing sessions, or developers moving between tools. Mixed into that stream is something far less ordinary: repeated, automated attempts to become someone else. That’s why identity work sits so close to the heart of daily blue-team operations.
Recent telemetry shows why password attacks still demand so much attention from the SOC:
- Identity-based attacks increased 32% during the first half of 2025, and 97% of the identity attacks observed by Microsoft were password-spray attempts.1 2
- In the three months preceding its 2026 Threat Report, Cloudflare found that 63% of observed logins involved credentials that had already been compromised elsewhere. 3
- Verizon reached a similarly important conclusion: Credential abuse accounted for 13% of initial access, but appeared in 39% of breaches when the entire attack chain was considered. 4
Those numbers matter because they describe the way modern intrusions actually behave. Many attacks no longer begin with obvious malware. They begin with stolen credentials, guessed passwords, misleading prompts, or social engineering that creates a clean-looking login event. Even when the first foothold comes from an exploit, attackers frequently pivot toward identity services, admin paths, backup platforms, and cloud control planes, because that’s where persistence and privilege live.
Mandiant’s 2026 report5 explicitly calls out attackers targeting identity services and recommends continuous identity verification, because interactive social engineering and long-term access abuse are increasingly central to real-world incidents.
The Anatomy of Password Attacks
Brute force and offline cracking
Brute force is the most direct form of password attack. MITRE defines it broadly: An attacker repeatedly guesses passwords when they don’t know the secret, either by testing credentials against a live service or by attacking previously acquired credential data such as password hashes offline. That matters because brute force is not only “try 1,000 passwords against one VPN account.” The same family also includes password guessing and password cracking against stolen hashes.6
Weak passwords also remain surprisingly easy to recover once their hashes or plaintext equivalents reach criminal datasets. After analyzing 231 million unique passwords exposed between 2023 and 2026, Kaspersky estimated that 68% could be cracked within one day.7 The 2026 Specops Breached Password Report reached a related conclusion: Among more than six billion malware-compromised credential records collected during 2025, 1.1 billion used eight-character passwords.8
From a defender’s perspective, online brute force is the noisy cousin. It tends to show up as a tight burst of failures against one account or one service. Offline cracking is quieter for defenders because it happens after the attacker has already taken a password database. That’s also where dictionary attacks and rainbow-table-style lookups come into the conversation.
OWASP notes that properly salted password hashing breaks the value of pre-computed lookup tables such as rainbow tables, and that slow, memory-hard hashing makes offline guessing more expensive and time-consuming. In plain English: if we store passwords badly, attackers get to test guesses cheaply; if we store them properly, we raise their cost and slow them down.9
Password spraying
Password spraying is what attackers use when they want to stay below the usual lockout noise. MITRE describes it as using one password, or a very small list of common passwords, against many different accounts in order to avoid lockouts that would normally follow repeated guesses against a single user. That’s why “one bad password attempt” is not always one bad password attempt. In a spray, the attacker is not betting on persistence against one person; they are betting that, somewhere in the directory, one employee still chose something predictable that also fits policy. 10
This is also why spraying is so dangerous in large organizations. A weak password on one low-profile account may be enough to get the attacker in the door. Once inside, they can enumerate access, pivot toward higher-value systems, and keep climbing. The attack is quiet by design, and MITRE notes that operators often throttle spraying attempts to avoid hitting detection thresholds.
Credential stuffing
Credential stuffing is less about guessing and more about reuse. MITRE defines it as using credentials obtained from unrelated breach dumps to access target accounts through password overlap. The attack works because many users still reuse passwords across personal and business services. If one old shopping-site password appears in a dump and that same password is still used anywhere in the enterprise, the attacker no longer has to crack anything. They just replay.11
This attack has become even more practical because the supply of stolen credentials keeps growing. IBM’s 2026 X-Force Threat Intelligence Index says 300,000 AI chatbot credentials were observed for sale on the dark web. That figure is useful beyond the headline: It shows that attackers are scavenging credentials not only for email and VPN, but also for tools employees increasingly trust inside daily workflows. In other words, the attack surface now includes the SaaS and AI services staff use as if they were part of the desktop.12
Behind the Glass with Elastic SIEM
In Elastic, our first job is to turn authentication noise into something we can reason about. The Elastic Common Schema gives us that common language. At a minimum, we care about event.category for the fact that an event is authentication-related, event.action for the source-specific action label, event.outcome for whether it succeeded or failed, source.ip for where the attempt came from, and user.name for who was targeted.
Elastic defines event.action as the specific action captured by the event, event.outcome as the success-or-failure result from the producer’s perspective, source.ip as the source IP address, and user.name as the short name or login of the user.13 That gives us a simple detection philosophy the whole business can understand:
- What happened? We look at event.action for the source’s own login label, which may be a vendor-specific success or failure string.
- Did it work? We check event.outcome for failure or success.
- Who was targeted? We pivot on user.name.
- Where did it come from? We pivot on source.ip.
For brute force, the logic is straightforward: A large number of authentication failures from one source against one user in a short window of time is suspicious, and a large number of failures followed by a success is even more suspicious. MITRE’s own detection guidance describes this pattern as a key way to spot brute force. Elastic’s pre-built anomaly jobs also include a detector for unusually large spikes in authentication failure events, explicitly noting that these can indicate password spraying, user enumeration, or brute force and may precede account takeover.
For password spraying, the pattern changes. We’re no longer looking for one user.name being hammered. We’re looking for one source.ip fanning out across many different user.name values, often with just one or two failures per account. MITRE’s detection guidance describes exactly that pattern: a high volume of authentication failures using a single password, or small set, across many different user accounts within a defined time window. In practice, that’s a correlation problem, not a single-event problem.
For credential stuffing, we look for rapid failures across many accounts, often from infrastructure that already looks wrong for the organization, and then we hunt for the single success that matters. MITRE describes credential stuffing detection as multiple failed authentication attempts using distinct username/password pairs from a single IP or session, including scenarios across cloud identity providers such as Azure AD, Okta, or Duo. MITRE also recommends considering risky authentication requests from anonymizing services and proxies, which fits well with IP reputation enrichment in a SOC workflow.
Elastic ML helps us catch what thresholds miss. Elastic’s pre-built jobs include auth_rare_hour_for_a_user, which flags a user logging in at a time that is unusual for that user, and auth_rare_source_ip_for_a_user, which flags a user logging in from an IP that is unusual for that user. That ‘s where we find the “quiet success” after the password attack: The login that technically worked, but doesn’t fit the person.
NIST’s current guidance also supports the use of unexpected geolocation or unusual IP address blocks as fraud indicators that can trigger additional risk-based controls. That’s the practical logic behind impossible-travel and unusual-location investigations.
What Good Defense Looks Like
Good password defense is rarely flashy. It’s a stack of boring choices done consistently, and those choices work.
- Use long passphrases. NIST now says passwords used as a single-factor authenticator should be at least 15 characters, and verifiers should allow at least 64 characters. It also says not to impose arbitrary composition rules and not to force periodic password changes without evidence of compromise. That’s why length and uniqueness matter more than trying to outsmart a complexity meter.14
- Use an enterprise password manager. The security benefit is simple: Credential stuffing depends on password reuse, and a password manager makes unique credentials per service practical at scale. Research published in 2025 also notes that password managers provide significant security benefits to users, even though browser-based usage still has to be hardened properly.
- Use phishing-resistant MFA where possible. NIST requires a phishing-resistant authentication option at AAL2 and explains that phishing resistance comes from cryptographic authentication, not from codes that users manually type into a page. That’s why FIDO2 security keys and passkeys are materially stronger than OTP-only flows.
- Treat unexpected MFA prompts as incidents, not annoyances. If you did not initiate a prompt, deny it and report it. In the SOC, that one user report is often what lets us connect a spray, a stuffing run, or a social-engineering attempt to the account it’s targeting.
Why This Is Everyone’s Job
Password attacks are common because they’re cheap, scalable, and often effective. They don’t require a zero-day. They only need human reuse, weak storage, or just enough patience to sit outside the lockout threshold. The SOC can see the patterns, tune the detections, enrich the IPs, and investigate the anomalies. But we can’t win this fight alone.
If you’re an employee, make today the day you replace your reused passwords and turn on stronger MFA. If you’re a developer or system owner, make sure passwords are hashed with modern, salted algorithms, and that authentication logs arrive with enough fidelity for the SOC to correlate what happened. But the best outcome isn’t that we catch an attack quickly – it’s that your choices make the attack unprofitable in the first place. 15
- Microsoft Digital Defense Report 2025 | Microsoft ↩︎
- Microsoft Releases 2025 Digital Defense Report: Highlighting the Changing Cyber Threat Landscape and the Importance of Security in the AI Era – Source Asia ↩︎
- Introducing the 2026 Cloudflare Threat Report | The Cloudflare Blog ↩︎
- 2026 Data Breach Investigations Report (DBIR) | Verizon ↩︎
- M-Trends 2026 Report: Executive Edition | Google Cloud ↩︎
- Brute Force, Technique T1110 – Enterprise | MITRE ATT&CK® ↩︎
- More than 50% of leaked passwords end with a number, Kaspersky’s latest research reveals ↩︎
- Most Common Passwords 2026 – Specops Software ↩︎
- Password Storage – OWASP Cheat Sheet Series ↩︎
- Brute Force: Password Spraying, Sub-technique T1110.003 – Enterprise | MITRE ATT&CK® ↩︎
- Brute Force: Credential Stuffing, Sub-technique T1110.004 – Enterprise | MITRE ATT&CK® ↩︎
- X-Force Threat Intelligence Index 2026 | IBM ↩︎
- Event fields | Elastic Common Schema (ECS) ↩︎
- NIST Special Publication 800-63B ↩︎
- Password Storage – OWASP Cheat Sheet Series ↩︎
These Solutions are Engineered by Humans
Did you learn from this article? Perhaps you’re already familiar with some of the techniques above? If you find cybersecurity issues interesting, maybe you could start in a cybersecurity or similar position here at Würth IT Italy.
Marco Fazio
Author
Latest posts by Marco Fazio
20. 05. 2026
Automation, Blue Team, SEC4U
Device Isolation with SOAR