Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0006 ✕ technique: T1110 ✕

Download CSV Show ATT&CK heatmap
  • External Login Password Spray Informational Identity Analytics 6 variations

    An abnormally high amount of user account login attempts were seen on a host within a short period of time. This may have resulted from a login password spray attack.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    1 Hour
    Deduplication:
    1 Day
    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Brute Force: Password Spraying (T1110.003)
    Required data: XDR Agent
    Attacker's goals: An attacker may be attempting to gain unauthorized access to user accounts.
    Investigative actions: Check the amount of time in between each login attempt. Investigate the reason behind the login failures and if any accounts were locked out. Look for any successful login attempts and the ratio of login success versus login failures.

    Variations

    External Login Password Spray Involving a Honey User

    Medium overridden

    An abnormally high amount of user account login attempts were seen on a host within a short period of time. This may have resulted from a login password spray attack. overridden

    External Login Password Spray from Multiple Source Hosts

    Informational overridden

    An abnormally high amount of user account login attempts were seen on a host within a short period of time. This may have resulted from a login password spray attack. overridden

    Successful External Login Password Spray on a Domain Controller

    Medium overridden

    An abnormally high amount of user account login attempts were seen on a domain controller within a short period of time. overridden

    Successful External Login Password Spray on a sensitive server

    Medium overridden

    An abnormally high amount of user account login attempts were seen on a sensitive server within a short period of time. overridden

    Successful External Login Password Spray

    Low overridden

    An abnormally high amount of user account login attempts were seen on a host within a short period of time. This may have resulted from a login password spray attack. overridden

    External Login Password Spray on a Domain Controller

    Low overridden

    An abnormally high amount of user account login attempts were seen on a domain controller within a short period of time. overridden