A continuous monitoring program identifies a spike in failed authentication attempts against a domain controller at 2 AM. The attempts use valid usernames but wrong passwords. Which attack technique does this most likely represent?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because repeated authentication failures with valid usernames but incorrect passwords are the definitive signature of password spraying (trying one or a few passwords against many accounts) or brute force (many passwords against one account). A is wrong because golden ticket attacks use forged Kerberos tickets and typically generate Kerberos events, not NTLM authentication failures.
Full explanation below image
Full Explanation
B is correct because repeated authentication failures with valid usernames but incorrect passwords are the definitive signature of password spraying (trying one or a few passwords against many accounts) or brute force (many passwords against one account). A is wrong because golden ticket attacks use forged Kerberos tickets and typically generate Kerberos events, not NTLM authentication failures. C is wrong because pass-the-hash uses captured password hashes and typically succeeds (generating success events), not repeated failures. D is wrong because Kerberoasting requests service tickets from the KDC and does not cause authentication failures.