Cross-source coverage

T1110.004 / ATT&CK

Brute Force: Credential Stuffing

31 rules across 6 sources.

From MITRE ATT&CK 19.2

Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.

Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies.

Typically, management services over commonly used ports are used when stuffing credentials. Commonly targeted services include the following:

  • SSH (22/TCP)
  • Telnet (23/TCP)
  • FTP (21/TCP)
  • NetBIOS / SMB / Samba (139/TCP & 445/TCP)
  • LDAP (389/TCP)
  • Kerberos (88/TCP)
  • RDP / Terminal Services (3389/TCP)
  • HTTP/HTTP Management Services (80/TCP & 443/TCP)
  • MSSQL (1433/TCP)
  • Oracle (1521/TCP)
  • MySQL (3306/TCP)
  • VNC (5900/TCP)

In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.

Platforms
Containers · ESXi · IaaS · Identity Provider · Linux · macOS · Network Devices · Office Suite · SaaS · Windows
Telemetry
WinEventLog:Securitylinux:syslogmacos:unifiedlogazure:signinlogssaas-app:authnetworkdevice:syslogkubernetes:apiserverm365:exchangeAWS:CloudTrail

How MITRE says to detect it DET0460

Credential Stuffing Detection via Reused Breached Credentials Across Services

Windows Analytic 1262

Multiple failed authentication attempts using distinct username/password pairs from a single IP address or session within a short time window, targeting common services like RDP or SMB

  • WinEventLog:Security EventCode=4625

Linux Analytic 1263

Rapid login failures across different users from a single IP address, targeting SSH or PAM login with distinct username-password pairs

  • linux:syslog SSH failed login

macOS Analytic 1264

Burst of failed authentications with rotating usernames against loginwindow or remote management service using reused breached credentials

  • macos:unifiedlog Login failure / authorization denied

Identity Provider Analytic 1265

Same source IP performing multiple authentication attempts using known breached username/password combinations across different identities in Azure AD, Okta, or Duo

  • azure:signinlogs status = failure

SaaS Analytic 1266

Multiple sign-in failures against cloud-based applications using username/password combinations leaked from unrelated domains

  • saas-app:auth login_failure

Network Devices Analytic 1267

Router/firewall/syslog logs showing authentication failures with unique usernames and reused credentials from same source IP

  • networkdevice:syslog AAA, RADIUS, or TACACS authentication

Containers Analytic 1268

Credential stuffing attempts against Kubernetes API or containerized login shells using stolen or leaked user credentials

  • kubernetes:apiserver authentication.k8s.io/v1beta1

Office Suite Analytic 1269

Use of leaked credential pairs against Outlook Web Access (OWA), Microsoft 365, or Exchange from a single client IP with multiple failures

  • m365:exchange Logon failure

IaaS Analytic 1270

Burst of failed login attempts across VM instances using leaked credential pairs from single IP in public cloud environments

  • AWS:CloudTrail eventName=ConsoleLogin | eventType=AwsConsoleSignIn

View on attack.mitre.org ↗

splunk/security_content

12 rules
Detection Severity Format
AWS High Number Of Failed Authentications From Ip Undefined SPL
AWS Multiple Users Failing To Authenticate From Ip Undefined SPL
AWS Unusual Number of Failed Authentications From Ip Undefined SPL
Azure AD Multiple Users Failing To Authenticate From Ip Undefined SPL
Azure AD Multi-Source Failed Authentications Spike Undefined SPL
Azure AD Unusual Number of Failed Authentications From Ip Undefined SPL
CrushFTP Max Simultaneous Users From IP Undefined SPL
GCP Multiple Users Failing To Authenticate From Ip Undefined SPL
GCP Unusual Number of Failed Authentications From Ip Undefined SPL
O365 Multiple Users Failing To Authenticate From Ip Undefined SPL

+ 2 more from splunk/security_content → showing the 10 highest-severity

elastic/detection-rules

10 rules
Detection Severity Format
Entra ID Excessive Account Lockouts Detected High Elastic TOML
Multiple SonicWall Login Failures Followed by Successful Login High Elastic TOML
Okta Successful Login After Credential Attack High Elastic TOML
Entra ID Sign-in Brute Force Attempted (Microsoft 365) Medium Elastic TOML
Entra ID User Sign-in Brute Force Attempted Medium Elastic TOML
M365 Identity User Account Lockouts Medium Elastic TOML
M365 Identity User Brute Force Attempted Medium Elastic TOML
Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy Medium Elastic TOML
Potential Okta Credential Stuffing (Single Source) Medium Elastic TOML
Multiple Okta User Authentication Events with Same Device Token Hash Low Elastic TOML

chronicle/detection-rules

3 rules
Detection Severity Format
aws_unusual_number_of_failed_authentications_from_the_same_ip Medium YARA-L
okta_threatinsight_login_failure_with_high_unknown_users Medium YARA-L
aws_high_number_of_unknown_user_authentication_attempts Low YARA-L

panther-labs/panther-analysis

3 rules
Detection Severity Format
Azure Excessive Account Lockouts High Panther Python
OpenAI Brute Force Login Success High Panther Python
OpenAI Credential Stuffing Medium Panther Python

socfortress/Wazuh-Rules

2 rules
Detection Severity Format
Brute-force SSH attempt with sshpass targeting localhost (T1110.004 - Credential Stuffing) High Wazuh XML
Credential stuffing attempt using sshpass inside shell script (T1110.004) High Wazuh XML

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Low & slow password attempts with volatile IP addresses Undefined KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.