# DomainPasswordSpray - Active Directory Password Spraying

```powershell
Import-Module .\DomainPasswordSpray.ps1
Invoke-DomainPasswordSpray -Password Welcome1 -OutFile spray_success -ErrorAction SilentlyContinue
```

***

**Mitigations:**

* **Enable Multi-Factor Authentication (MFA)**: Protects against unauthorized access.
* **Enforce Least Privilege & Network Segmentation**: Restrict access to necessary resources.
* **Use Strong Password Policies & Filters**: Prevent weak password usage.
* **Separate Admin & User Accounts**: Reduce risk of privilege escalation.

***

**Detection:**

Monitor logs for suspicious activity:

* **Event ID 4625**: Failed Logon Attempts
* **Event ID 4771**: Kerberos Pre-Authentication Failures

***

**External Password Spraying Targets:**

* **Microsoft 365, Outlook Web Exchange**
* **RDS Portals, Citrix, VMware Horizon**
* **VPN Portals (Fortinet, SonicWall, OpenVPN)**
* **Custom Web Apps using AD Authentication**
