T1110.004 | LoFP

T1110.004

Title	Tags
a source ip failing to authenticate with multiple users in a short period of time is not common legitimate behavior.	T1110.003 T1110.004 t1586.003 okta tenant o365 tenant splunk
a source ip failing to authenticate with multiple users is not a common for legitimate behavior.	T1110.003 T1110.004 t1586.003 azure active directory splunk
an ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.	T1110.003 T1110.004 aws account splunk
in environments where multiple users legitimately access crushftp from behind the same nat or proxy, this may generate false positives. tune the threshold based on your organization's usage patterns.	t1110.001 T1110.004 web server splunk
no known false positives for this detection. please review this alert	T1110.003 T1110.004 t1586.003 google cloud platform tenant splunk
no known false postives for this detection. please review this alert	T1110.003 T1110.004 t1586.003 aws account splunk
this detection may yield false positives in scenarios where legitimate bulk sign-in activities occur, such as during company-wide system updates or when users are accessing resources from varying locations in a short time frame, such as in the case of vpns or cloud services that rotate ip addresses. filter as needed.	T1110.003 T1110.004 t1586.003 azure tenant o365 tenant splunk
vulnerability scanners or system administration tools may also trigger this detection. filter as needed.	t1003.002 t1021.002 t1087 T1110.004 t1135 endpoint splunk