LoFP LoFP / t1110.001

t1110.001

TitleTags
a user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
a user with successful authentication events from different ips may also represent the legitimate use of more than one device. filter as needed and/or customize the threshold to fit your environment.
account fallback reasons (after failed login with specific account)
administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time.
although unusual, users who have lost their passwords may trigger this detection. filter as needed.
an ip address with more than 20 failed authentication attempts in the span of 10 minutes may also be triggered by a broken application.
in environments where multiple users legitimately access crushftp from behind the same nat or proxy, this may generate false positives. tune the threshold based on your organization's usage patterns.
rdp gateways may have unusually high amounts of traffic from all other hosts' rdp applications in the network.any legitimate rdp traffic using wrong/expired credentials will be also detected as a false positive.
software that uses the caret encased keywords pass and user in its command line
users may genuinely mistype or forget the password.