Lion Cipher Lab
Detect distributed password spraying with a fleet-wide analytic (build it from scratch)
- SOC Analyst / Blue Team
- Advanced
- ~90 min
- Free · no account required
Why it matters
Password spraying is one of the most common ways real intrusions start, and it is specifically designed to slip past the detection most shops actually have. The naive rule everyone writes first — 'alert when one account fails to log in N times' — is blind to it by design, because a sprayer tries ONE password against MANY accounts, low and slow, from MANY source IPs, so no single account ever crosses the lockout line. Learning to pivot the detection the other way — counting how many DISTINCT accounts across the whole estate are failing at once — and then honestly measuring and tuning that…
What you'll learn
- Detection engineering
- Password-spray detection
- Rolling-window analytics
- Base-rate / false-positive reasoning
- Threshold tuning and evasion testing
- Reading authentication logs (Windows 4625/4624, Entra sign-ins)
Steps in this lab
- When you reach for this — spraying vs. brute force
- The real-world signals this maps to
- Set up a scratch folder and confirm Python runs
- Create the whole thing in one file
- Run it and read Part 1
- Why a fixed threshold is a trap — the base rate
- Now watch the attacker adapt — and the analytic go blind
- Re-tune with the spray SHAPE, not just the count
- When this analytic is blind — the failure modes to say out loud