Authentication logs show about 1,200 different employee usernames each receiving one or two failed sign-in attempts over six hours, all using the same seasonal password and originating from a small set of IP addresses. No accounts were locked out. Which credential attack is MOST likely underway?

Password spraying tries a small number of commonly used passwords against a large number of accounts. By limiting attempts per account and spreading them over time, the attacker stays under lockout thresholds while betting that at least some users chose the guessed password. The indicators in this scenario match precisely: many usernames, one or two attempts each, one shared seasonal password, a few source addresses, and no lockouts. Brute force tries many passwords against a single account or a few accounts, so it produces a high attempt count per account and frequently triggers lockout. User enumeration seeks to determine which usernames are valid, typically by observing differences in error messages or response times; the attacker here is already supplying a password guess against a known username list. Credential replay reuses a captured credential or authentication token, which would appear as successful authentications with valid credentials rather than widespread failures with one guessed password. Exam caveat: spraying is designed to evade per-account lockout, so detection depends on correlating failures across accounts and sources rather than within a single account. Operational check: block the source addresses, check for any successful sign-ins with the sprayed password, enforce MFA and banned-password lists, and alert on failures spread across many accounts from the same origin.