Analytics
Informational
✕
VPN login Brute-Force attempt
A user account failed to log in to a VPN service multiple times in a short time period. This may indicate a brute-force attack.
- Module:
- Identity Analytics
- Data source:
- Palo Alto Networks Global Protect, Third-Party VPNs
ATT&CK tactics: Credential Access (TA0006) Resource Development (TA0042)
ATT&CK techniques: Brute Force (T1110) Compromise Accounts (T1586) Brute Force: Password Guessing (T1110.001)
Attacker's goals:
An attacker attempts to gain access to the account.
Investigative actions:
Verify successful connections by the user account, as these can indicate the attacker managed to guess the credentials. Analyze login patterns for abnormal times, locations, or IPs for suspicious activity. Look for VPN login attempts from countries where the organization does not typically operate. Cross-reference the IP addresses with threat intelligence sources. Follow further actions taken by the account.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day
2 variations:
- Successful VPN Login Brute Force Low (parent: Informational)
- VPN login brute-force attempt with suspicious characteristics Low (parent: Informational)