[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 1 · 1.2.a
AP Cybersecurity · Introduction to Security
Common Signs of a Password Attack
Every guess is a real login attempt — so the attack writes itself into the log.
key ideaAn online password attack is loud. Look for volume, timing, and origin — then find the one success.
What to look for
In an online password attack the adversary submits guesses to the live service — common passwords, common patterns, or credentials stolen elsewhere. Because every guess is a real login attempt, the attack writes itself into the authentication log.
| Sign | What it looks like | Why it appears |
|---|
| many failed attempts | dozens or hundreds in seconds or minutes | automation is trying a list |
| unusual times | 03:00 activity on a nine-to-five account | the tool runs on the adversary's schedule |
| unknown devices | a browser string or device ID never seen before | the attempt is not coming from the user's machine |
| unfamiliar locations | a source address from an unexpected region | the adversary is elsewhere, or behind a proxy |
| a success among failures | one OK line in a block of FAILs | the guess list finally hit |
The first three are the signals; the last is the incident. Detection that stops at ‘lots of failures’ misses the line that actually matters.
| Pattern in the log | Likely cause | Response |
|---|
| many failures, one user, one source | targeted guessing against that account | lock the account, block the source |
| many failures, many users, one source | credential stuffing with a stolen list | block the source, force resets on any hits |
| few failures, many users, spread over hours | password spraying — one common password against everyone | alert on the pattern, not on any single account |
| failures then a success from the same source | the attack succeeded | treat as a breach — reset and investigate |
Spraying is the one that hides from per-account thresholds: three attempts per user never trips a five-strike lockout, yet the same password is being tried across the whole organization.
Reading the evidence
Volume, timing and origin are independent signals. Any one of them can be explained away; together they are not a coincidence.Read a log the way you would read a story: who, from where, when, and what happened. The interesting line is almost never the first one.
authentication log — one account, one nightfour failures, then a success
2026-03-14 02:41:07 user=r.okoye result=FAIL src=203.0.113.44 agent=curl/8.4
2026-03-14 02:41:09 user=r.okoye result=FAIL src=203.0.113.44 agent=curl/8.4
2026-03-14 02:41:11 user=r.okoye result=FAIL src=203.0.113.44 agent=curl/8.4
2026-03-14 02:41:14 user=r.okoye result=FAIL src=203.0.113.44 agent=curl/8.4
2026-03-14 02:41:16 user=r.okoye result=OK src=203.0.113.44 agent=curl/8.4
2026-03-14 09:02:55 user=r.okoye result=OK src=198.51.100.7 agent=Firefox/128
02:41five attempts in nine seconds — no human types that fastcurl/8.4a command-line tool, not a browser — automationresult=OKthe fifth attempt succeeded — this is a breach, not a scare09:02the real user signs in later, unaware
Worked analysis
EX 1
Classify the activity
Overnight, one account shows 147 failed logins from a single address, then one success. What happened, and what is the priority?
1
Count and time the attempts
147 in one window is automated, not a forgetful user.
2
Check the origin
A single unfamiliar source across all attempts confirms one tool driving them.
3
Find the outcome
The success at the end is the whole point — the guessing worked.
4
Set the priority
This is an account compromise, not a failed attack. Containment comes before analysis.
5
Act
Reset the credential, terminate active sessions, block the source, then review what the account could reach.
EX 2
The quiet one
Across 400 accounts, each shows exactly 2 failed logins over three hours, all from different addresses. No account is locked. Is this an attack?
1
Test it against per-account rules
Two failures trips nothing. Per-account thresholds see nothing here.
2
Change the unit of analysis
Count across the organization rather than the account: 800 failures in three hours.
3
Name the technique
Password spraying — a few very common passwords tried against many users.
4
Explain the address spread
Rotating sources is deliberate, to defeat source-based blocking.
5
Give the detection
Alert on organization-wide failure rates and on repeated failures for the same password hash, not on per-account counts.
EX 3
Explaining it away
A single account logs 6 failures at 09:05 from the user's usual laptop, then a success. Is this an attack?
1
Check the origin
A known device the account uses daily.
2
Check the timing
09:05 on a weekday — the user's normal hours.
3
Check the rate
Six attempts over a minute is human typing speed, not automation.
4
Weigh the signals
All three point the same way: this looks like someone mistyping a password.
5
State the lesson
The signals are only meaningful together. Alerting on failure count alone buries analysts in noise.
Check yourself
Name the three signs of an online password attack the CED lists.
Show answer
Many failed attempts in a short duration, login attempts at unusual times, and attempts from unknown devices.
Why does an online password attack leave evidence when an offline one does not?
Show answer
Every guess is a real login attempt against the live service, so each one is written to the authentication log. Offline cracking happens on the adversary's own hardware and touches nothing you can see.
Why does password spraying evade a five-strike lockout?
Show answer
It tries only 2–3 passwords per account, so no single account crosses the threshold — the pattern is only visible when failures are counted across the whole organization.
You see many failures and then one success from the same source. What changes about your response?
Show answer
It stops being a detection and becomes an incident: reset the credential, terminate active sessions, block the source, and review everything that account could reach.