Attack scenario
Credential stuffing and password spraying
An adversary automatically tests leaked username-password pairs or a small set of common passwords against many accounts.
Why this scenario matters
Credential stuffing exploits password reuse, while password spraying distributes attempts across many accounts to avoid lockout. Targets include web, VPN, cloud, email, APIs, and identity providers, often through distributed infrastructure.
Defense combines phishing-resistant MFA, risk-based authentication, breached-password checks, bot management, smart lockout, sign-in telemetry, IP and device reputation, and cross-account attempt correlation.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Credential Access
- Initial Access
- Persistence
- Privilege Escalation
- Stealth
Relevant ATT&CK techniques
Reference frameworks
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.