1Three shapes of the same attack
Brute force (T1110) tries many passwords against one account. Password spraying (T1110.003) tries a few common passwords against many accounts, staying under lockout limits. Credential stuffing (T1110.004) replays username and password pairs leaked from other breaches.
Each leaves a different pattern. Brute force: many failures on one account. Spraying: one or two failures on each of many accounts. Stuffing: many accounts, often from new or rotating sources, with some successes where people reused passwords.
2Why one success matters most
Hundreds of failures are noise. The single success among them is the incident, because the attacker now holds a valid account (T1078) and looks like a normal user from then on.
When failures spike, look for successes from the same source or in the same window, and for what those accounts did next.
3What stops it
Multi-factor authentication defeats a stolen password alone; phishing-resistant MFA (FIDO2 or passkeys) also resists real-time phishing. Rate limiting and lockouts slow brute force. Checking passwords against known-breached lists blocks reused ones.