AN1262
Analytic 1262
Windows
Multiple failed authentication attempts using distinct username/password pairs from a single IP address or session within a short time window, targeting common services like RDP or SMB
WinEventLog:Security
EventCode=4625
[UsernameUniquenessThreshold]
Minimum number of unique usernames in failed login attempts before triggering alert
[TimeWindow]
Duration (e.g., 5 minutes) to observe the behavior chain of rapid login attempts
[SourceIPScope]
Whether to group by full IP or CIDR block for bursty behavior from botnets
AN1263
Analytic 1263
Linux
Rapid login failures across different users from a single IP address, targeting SSH or PAM login with distinct username-password pairs
linux:syslog
SSH failed login
[LoginFailureRatio]
Ratio of failed logins per unique user attempted
[AuthServiceFilter]
Restrict detection to certain protocols (e.g., sshd, login, su)
AN1264
Analytic 1264
macOS
Burst of failed authentications with rotating usernames against loginwindow or remote management service using reused breached credentials
macos:unifiedlog
Login failure / authorization denied
[DistinctUsernameCount]
Tunable threshold for number of attempted usernames in a time window
[RemoteAccessFilter]
Restrict behavior detection to remote login interfaces
AN1265
Analytic 1265
Identity Provider
Same source IP performing multiple authentication attempts using known breached username/password combinations across different identities in Azure AD, Okta, or Duo
azure:signinlogs
status = failure
[BreachedCredentialSourceMatch]
Optional enrichment using known leaked credentials database
[SSOServiceScope]
Targeting only federated or hybrid identity auth flows
AN1266
Analytic 1266
SaaS
Multiple sign-in failures against cloud-based applications using username/password combinations leaked from unrelated domains
saas-app:auth
login_failure
[UserAccountOverlap]
Correlate credentials reused across multiple SaaS platforms
[FailedAttemptsPerIP]
Number of failed logins from same IP before alerting
AN1267
Analytic 1267
Network Devices
Router/firewall/syslog logs showing authentication failures with unique usernames and reused credentials from same source IP
networkdevice:syslog
AAA, RADIUS, or TACACS authentication
[AuthProtocolFilter]
Limit detection to interactive logins rather than SNMP/RPC
[FailedAuthBurst]
Detection trigger when failure rate exceeds normal profile
AN1268
Analytic 1268
Containers
Credential stuffing attempts against Kubernetes API or containerized login shells using stolen or leaked user credentials
kubernetes:apiserver
authentication.k8s.io/v1beta1
[PodAccessScope]
Detect attempts across multiple pods/namespaces using same IP
[CredentialSetSize]
Number of username/password pairs used in attack attempt
AN1269
Analytic 1269
Office Suite
Use of leaked credential pairs against Outlook Web Access (OWA), Microsoft 365, or Exchange from a single client IP with multiple failures
m365:exchange
Logon failure
[PasswordSourceMatch]
Optional: cross-reference to haveibeenpwned or internal credential dumps
[MailboxLoginThreshold]
Tunable value for how many unique mailbox attempts trigger alert
AN1270
Analytic 1270
IaaS
Burst of failed login attempts across VM instances using leaked credential pairs from single IP in public cloud environments
AWS:CloudTrail
eventName=ConsoleLogin | eventType=AwsConsoleSignIn
[InstanceIDScope]
Define if detection should group logins per host or across cluster
[IPBehaviorHistory]
Correlate against past IP reputation or behavioral profiles