Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters.

Download CSV Show ATT&CK heatmap
  • Internal Login Password Spray Informational Identity Analytics 5 variations

    An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    1 Hour
    Deduplication:
    1 Day
    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Brute Force: Password Spraying (T1110.003)
    Required data: XDR Agent
    Attacker's goals: An attacker may be attempting to gain unauthorized access to user accounts.
    Investigative actions: Check the amount of time in between each authentication attempt. Investigate the reason behind the login failures and if any accounts were locked out. Look for any successful authentication attempts and the ratio of login success versus login failures. Monitor for potential abuse of MFA on users who have successfully logged in.

    Variations

    Suspicious intensive and short internal Login Password Spray

    Medium overridden

    An abnormally high number of login attempts within a very short period of time and suspicious automated behavior. overridden

    High-Volume Internal Password Spray Attack

    Medium overridden

    Over 500 user accounts failed to login within a short period of time. overridden

    Internal Login Password Spray with many wrong password attempts

    Low overridden

    An abnormally high amount of user account login attempts with wrong password were seen with a wrong password within a short period of time. overridden

    Internal Login Password Spray attempt on local user

    Low overridden

    An abnormally high number of login attempts with the same username to different domains or local machines within a short period of time. overridden

    Internal Login Password Spray on many users

    Low overridden

    An abnormally high amount of user account login attempts were seen from a host within a short period of time. This may have resulted from a login password spray attack. overridden