AN1336
Analytic 1336
Windows
A high volume of authentication failures using a single password (or small set) across many different user accounts within a defined time window
WinEventLog:Security
EventCode=4625, 4771, 4648
[PasswordReuseThreshold]
Number of distinct accounts a password is used against before alerting
[TimeWindow]
Window over which the correlation is measured (e.g., 10 mins)
[TargetGroupFilter]
Limit detection to sensitive or monitored user groups (e.g., Admins)
AN1337
Analytic 1337
Linux
Authentication failures across different accounts using a repeated or similar password via SSH or PAM stack within a short window
linux:syslog
Failed password for invalid user
[PasswordReusePattern]
Repetition or minor variation of the same password across user attempts
[IPAggregationWindow]
Length of time to observe distributed spray attempts from single source
AN1338
Analytic 1338
macOS
Multiple failed login attempts across different users using common password patterns (e.g., 'Welcome2023')
macos:unifiedlog
Login Window and Authd errors
[RetryCountThreshold]
Total number of attempts before alerting
[CommonPasswordList]
List of passwords considered suspicious due to widespread use
AN1339
Analytic 1339
Identity Provider
Sign-in failures across enterprise SSO applications or SaaS platforms from same IP address using the same password against multiple user identities
azure:signinlogs
Failure Reason + UserPrincipalName
[GeoIPAnomalyCheck]
Use geolocation mismatches to strengthen signal
[FailedUserRatio]
Proportion of total user base affected to filter noise
AN1340
Analytic 1340
Network Devices
Authentication failure logs on routers/switches showing repeated use of default or common passwords across multiple accounts
networkdevice:syslog
AAA or TACACS authentication failures
[AuthFailureBurst]
Cluster of failed attempts in short period indicating spray
[InterfaceFilter]
Limit detection to console/SSH vs web UI interfaces
AN1341
Analytic 1341
Containers
Repeated failed authentication attempts to container APIs, control planes, or login shells across many user names using same password
kubernetes:audit
Failed login
[OrchestrationScope]
Detect spray attempts scoped to single pod vs full cluster
[ServiceAccountFilter]
Limit detection to non-service accounts to reduce noise
AN1342
Analytic 1342
Office Suite
Failed authentication attempts across user mailboxes using identical or common passwords (e.g., OWA brute attempts)
m365:exchange
FailedLogin
[MailboxAccessAttempts]
Threshold on mailbox login failures by same IP
[EmailPatternAnalysis]
Match target usernames to common spray dictionaries
AN1343
Analytic 1343
SaaS
SaaS applications receiving authentication failures for dozens of accounts using same password or login signature
saas:auth
signin_failed
[CloudAppScope]
Restrict detection to identity providers or select high-risk SaaS platforms
[UserPopulationSensitivity]
Adjust based on size and role of account pool