LoFP / a misconfigured service account can trigger this alert. a password change on an account used by an email client can trigger this alert. security test cycles that include brute force or password spraying activities may trigger this alert.

Techniques

• T1110

Sample rules

Spike in Failed Logon Events

• source: elastic
• technicques:
  • T1110

Description

A machine learning job found an unusually large spike in authentication failure events. This can be due to password spraying, user enumeration or brute force activity and may be a precursor to account takeover or credentialed access.

Detection logic