Analytics Alerts
Browse the Cortex analytics alert reference.
1 alert match the current filters. tactic: TA0042 ✕
Download CSV Show ATT&CK heatmapPossible Password Spray in universal authentication Informational Identity Analytics 4 variations
An abnormally high amount of universal authentication attempts were seen within a short period of time. This may indicate a password spray attack.
- Activation:
- 14 Days
- Training:
- 30 Days
- Test:
- 1 Hour
- Deduplication:
- 1 Day
ATT&CK tactics: Credential Access (TA0006) Resource Development (TA0042)ATT&CK techniques: Brute Force: Password Spraying (T1110.003) Brute Force: Password Guessing (T1110.001) Compromise Accounts: Cloud Accounts (T1586.003)Attacker's goals: An attacker may be attempting to gain unauthorized access to user accounts.Investigative actions: Determine whether this was part of a legitimate action. Check if the user usually logs in from this country. Check whether a successful login was made after unsuccessful attempts.Variations
Possible Password Spray in universal authentication Involving a Honey User
Medium overridden
An abnormally high amount of universal authentication attempts were seen within a short period of time. This may indicate a password spray attack. overridden
Suspicious Password Spray in universal authentication
Medium overridden
An abnormally high amount of universal authentication attempts were seen within a short period of time. This may indicate a password spray attack. overridden
Password Spray in universal authentication
Low overridden
An abnormally high amount of universal authentication attempts were seen within a short period of time. This may indicate a password spray attack. overridden
Possible Password Spray in universal authentication with successful authentication
Informational overridden
An abnormally high amount of universal authentication attempts were seen within a short period of time. This may indicate a password spray attack. overridden