Brute-Force — CraftedSignal Threat Feed

D-Link DWM-222W USB Wi-Fi Adapter Brute-Force Protection Bypass Vulnerability

hello@craftedsignal.io — Fri, 24 Apr 2026 04:16:23 +0000

The D-Link DWM-222W USB Wi-Fi Adapter is susceptible to a brute-force protection bypass vulnerability (CVE-2026-6947). This flaw allows an attacker on an adjacent network to circumvent the built-in login attempt limits. By repeatedly attempting different credentials without being blocked, an attacker can successfully brute-force the password and gain unauthorized access to the device. This vulnerability poses a significant risk as it enables attackers to potentially reconfigure the device, intercept network traffic, or use the compromised device as a pivot point for further attacks within the network. Successful exploitation leads to full control over the D-Link Wi-Fi adapter.

Attack Chain

The attacker locates a vulnerable D-Link DWM-222W USB Wi-Fi Adapter within adjacent network range.
The attacker initiates network communication with the device, targeting its login interface, likely via HTTP or HTTPS.
The attacker sends a series of login requests with different username and password combinations.
Due to the brute-force protection bypass, the device does not enforce login attempt limits or implement account lockout mechanisms.
The attacker continues sending login requests until the correct credentials are found.
Upon successful authentication, the attacker gains administrative access to the D-Link DWM-222W USB Wi-Fi Adapter’s configuration interface.
The attacker reconfigures the device to their specifications potentially enabling remote access.

Impact

Successful exploitation of CVE-2026-6947 allows an attacker to gain complete control over the D-Link DWM-222W USB Wi-Fi Adapter. This can lead to unauthorized access to the network it connects to, data interception, or the device being used as a launchpad for further attacks within the network. The impact is significant, as it bypasses standard security measures and grants full administrative privileges to the attacker.

Recommendation

Monitor network traffic for excessive authentication attempts targeting the D-Link DWM-222W USB Wi-Fi Adapter to detect potential brute-force attacks. Deploy the Sigma rule Detect Excessive Authentication Attempts to identify such activity.
Implement network segmentation to limit the impact of a compromised D-Link DWM-222W USB Wi-Fi Adapter.
If possible, disable remote management interfaces on the D-Link DWM-222W USB Wi-Fi Adapter to reduce the attack surface.

Chamilo LMS REST API Key Brute-Force Vulnerability (CVE-2026-33710)

hello@craftedsignal.io — Sat, 11 Apr 2026 12:00:00 +0000

Chamilo LMS, a popular learning management system, contains a vulnerability in versions prior to 1.11.38 and 2.0.0-RC.3 related to the generation of REST API keys (CVE-2026-33710). The API keys are generated using a flawed algorithm: md5(time() + (user_id * 5) - rand(10000, 10000)). Due to rand(10000, 10000) always returning 10000, the formula simplifies to md5(timestamp + user_id*5 - 10000). An attacker knowing a valid username and a rough estimate of when the API key was generated can brute-force the key due to the limited entropy. This vulnerability allows unauthorized access to the Chamilo LMS REST API. The vulnerability was reported and patched in versions 1.11.38 and 2.0.0-RC.3. This poses a significant threat to educational institutions and organizations using vulnerable versions of Chamilo LMS.

Attack Chain

Attacker identifies a target Chamilo LMS instance running a vulnerable version (prior to 1.11.38 or 2.0.0-RC.3).
Attacker obtains a valid username on the target Chamilo LMS instance through OSINT or credential stuffing.
Attacker estimates the API key creation time. This might be inferred from user activity or system logs.
Attacker crafts a script to generate potential API keys based on the predictable formula md5(timestamp + user_id*5 - 10000) using the known username and estimated timestamp.
The script iterates through a range of timestamps around the estimated creation time, generating corresponding MD5 hashes.
Attacker sends API requests with the generated API keys to the Chamilo LMS server.
The server validates the API key against the user.
Upon successful validation, the attacker gains unauthorized access to the Chamilo LMS REST API, potentially allowing them to modify course content, access user data, or perform other malicious actions.

Impact

Successful exploitation of CVE-2026-33710 can lead to unauthorized access to sensitive data within the Chamilo LMS, including user information, course materials, and grades. This could result in data breaches, academic fraud, and reputational damage for affected organizations. The vulnerability affects all organizations running vulnerable versions of Chamilo LMS; the number of victims is correlated to the number of vulnerable deployments.

Recommendation

Upgrade Chamilo LMS installations to version 1.11.38 or 2.0.0-RC.3 or later to patch CVE-2026-33710.
Monitor web server logs for unusual API requests originating from unexpected IP addresses, especially those containing potentially valid API keys by deploying the provided Sigma rule.
Implement rate limiting on API endpoints to mitigate brute-force attempts.
If upgrading is not immediately feasible, consider temporarily disabling the REST API.
Review and audit user permissions within Chamilo LMS to minimize the impact of potential unauthorized access.

Spike in Successful Logon Events from a Source IP

hello@craftedsignal.io — Thu, 02 Apr 2026 13:25:14 +0000

This alert triggers when an Elastic machine learning job identifies a significant spike in successful authentication events originating from a specific source IP address. The underlying cause may range from legitimate administrative activity to malicious attempts at credential compromise, such as password spraying, user enumeration, or brute force attacks. The rule requires a minimum Elastic Stack version of 9.4.0 and relies on data ingested via Elastic Defend, Auditd Manager, or the System integration. The machine learning job associated with this rule is named “auth_high_count_logon_events_for_a_source_ip_ea”. While build servers and CI systems can trigger this alert as false positives, its presence should always prompt investigation to rule out credential compromise attempts.

Attack Chain

Initial Access: An attacker gains initial access to a network or system (not explicitly described in source).
Credential Harvesting: The attacker attempts to gather valid credentials through password spraying or brute-force attacks (T1110, T1110.003).
Account Discovery: The attacker enumerates user accounts to identify potential targets, often performed in conjunction with password attacks.
Successful Authentication: Using compromised credentials, the attacker successfully authenticates to a system or service (T1078, T1078.002, T1078.003).
Lateral Movement: After successful authentication, the attacker potentially moves laterally within the network using valid accounts (not explicitly described in source).
Privilege Escalation: The attacker may attempt to escalate privileges to gain higher-level access (not explicitly described in source).
Data Exfiltration/Impact: After gaining sufficient access, the attacker may exfiltrate sensitive data or cause damage to the system or network (not explicitly described in source).

Impact

Successful exploitation can lead to unauthorized access to sensitive data, systems, and services. The number of affected users and the extent of the damage depend on the scope of the compromised credentials and the attacker’s objectives. This can impact any sector, as credential compromise is a common attack vector across various industries.

Recommendation

Enable and configure the Elastic Defend, Auditd Manager, or System integrations to provide the necessary data for the machine learning job (see Setup section).
Install the associated Machine Learning job “auth_high_count_logon_events_for_a_source_ip_ea” to enable the detection (see Setup section).
Tune the anomaly threshold of the machine learning job based on your environment to reduce false positives (anomaly_threshold metadata).
Investigate alerts triggered by this rule, focusing on identifying the involved assets, users, and source IP addresses (see Note section).

OpenClaw Webhook Rate Limit Bypass Vulnerability (CVE-2026-34505)

hello@craftedsignal.io — Tue, 31 Mar 2026 12:16:30 +0000

OpenClaw versions prior to 2026.3.12 are vulnerable to a rate-limiting bypass (CVE-2026-34505). The vulnerability exists because rate limiting is only applied after successful webhook authentication. This design flaw enables attackers to send numerous authentication requests with incorrect secrets without triggering rate limits. The vulnerability was reported on March 31, 2026. Successful exploitation allows attackers to systematically guess webhook secrets and subsequently submit forged…

Bitbucket User Login Failure Detection

hello@craftedsignal.io — Fri, 08 Mar 2024 15:00:00 +0000

This threat brief focuses on detecting user login failures within Bitbucket environments. Monitoring failed login attempts is crucial as it can indicate various malicious activities, including credential stuffing, brute-force attacks, or attempts to gain unauthorized initial access. The audit logs in Bitbucket record details of these authentication failures, providing valuable data for security monitoring. The rule provided detects these events and can be used for correlation with other security events based on the “author.name” field for enhanced accuracy and context. Requires “Advance” log level to receive audit events.

Attack Chain

Initial Access Attempt: An attacker attempts to gain initial access to a Bitbucket account using a compromised or guessed username.
Credential Guessing: The attacker attempts to guess the user’s password through manual attempts or automated tools.
Authentication Failure: Bitbucket records a “User login failed” event due to incorrect credentials. The auditType.category is Authentication, and auditType.action is User login failed.
Multiple Failed Attempts: The attacker repeats the login attempts with different password variations or using a list of compromised credentials.
Account Lockout (Optional): Depending on Bitbucket’s configuration, repeated failed login attempts may trigger an account lockout.
Successful Login (Potential): After multiple attempts, the attacker may eventually guess the correct password or use a valid compromised credential.
Privilege Escalation/Persistence (If Successful): If successful, the attacker could escalate privileges, establish persistence, or perform other malicious actions within the Bitbucket environment.

Impact

Successful exploitation can lead to unauthorized access to sensitive code repositories, intellectual property theft, and potential supply chain compromise. Attackers could inject malicious code, modify existing code, or exfiltrate sensitive data. Detecting these failed login attempts early can prevent significant damage. Although the number of victims cannot be determined with this specific detection, a successful attack can have far-reaching impacts.

Recommendation

Deploy the Sigma rule “Bitbucket User Login Failure” to your SIEM to detect suspicious authentication failures (logsource: bitbucket, service: audit). Tune for your environment by correlating on the author.name field.
Investigate the source IP addresses associated with the failed login attempts to identify potential malicious actors.
Implement multi-factor authentication (MFA) to significantly reduce the risk of successful credential-based attacks.
Monitor for unusual activity following any successful login after a series of failures.
Enforce strong password policies to reduce the effectiveness of brute-force attacks.

Multiple Logon Failure from the Same Source Address

hello@craftedsignal.io — Mon, 29 Jan 2024 12:00:00 +0000

This detection rule identifies potential password guessing or brute force activity against Windows systems. It focuses on detecting a high number of failed network logon attempts originating from a single source IP address within a short time frame. The rule analyzes Windows Security Event Logs, specifically looking for event category “authentication” and event action “logon-failed”. By aggregating failed authentication counts within a 60-second window and filtering out common authentication misconfiguration errors, the rule aims to pinpoint suspicious activity indicative of credential access attempts. This is important for defenders as it highlights potential breaches or malicious actors attempting to compromise user accounts via brute-force or password spraying attacks.

Attack Chain

The attacker initiates a network connection to a Windows system, likely targeting a service such as SMB or RDP.
The attacker attempts to authenticate using a list of usernames and passwords or commonly used passwords, generating failed logon attempts (Event ID 4625).
The Windows system logs the failed authentication attempts in the Security Event Log.
The detection rule monitors the Security Event Log for failed logon events (event.category == “authentication” and event.action == “logon-failed”).
The rule aggregates the number of failed logon attempts from the same source IP address within a 60-second time window.
If the number of failed attempts exceeds a threshold (e.g., 100) and involves multiple target usernames (Esql.count_distinct_target_user_name >= 2), the rule triggers a detection.
The attacker may continue attempts after initial failures or pivot to successful credentials for lateral movement.
Successful credential access can lead to privilege escalation, data exfiltration, or other malicious activities.

Impact

Successful brute-force or password spraying attacks can lead to unauthorized access to user accounts and sensitive data. The impact can range from minor inconvenience to significant data breaches and financial losses, depending on the compromised accounts and the data they have access to. The rule aims to reduce the window of opportunity for attackers to gain a foothold in the environment.

Recommendation

Enable Audit Logon to generate the necessary Windows Security Event Logs. Follow the setup instructions outlined in the rule documentation.
Deploy the Sigma rule “Multiple Logon Failure from the Same Source Address” to your SIEM and tune the threshold values (Esql.failed_auth_count and Esql.count_distinct_target_user_name) to minimize false positives in your environment.
Investigate any triggered alerts by examining the logon failure reason codes and the targeted user names as described in the rule’s investigation guide.
Monitor network connections from the source IP address for any suspicious outbound traffic or lateral movement activity.
Review and enforce strong password policies to mitigate the risk of successful brute-force attacks.

Multiple Logon Failure Followed by Logon Success

hello@craftedsignal.io — Tue, 09 Jan 2024 14:00:00 +0000

This detection rule focuses on identifying brute-force or password guessing attacks against Windows systems. It detects multiple failed logon attempts originating from the same source IP address, followed by a successful logon. This pattern suggests an attacker attempting to guess credentials to gain unauthorized access to an account. The rule leverages Windows Security Event Logs to monitor authentication events. This activity is important for defenders because successful brute-force attacks can lead to account compromise, data breaches, and further malicious activities within the network. The rule uses EQL and analyzes logs-system.security*, logs-windows.forwarded*, and winlogbeat-* indices.

Attack Chain

The attacker initiates multiple failed logon attempts to a Windows system using various username and password combinations. These attempts originate from a single source IP address and target network logon types.
The system records each failed logon attempt as a Windows Security Event Log event (Event ID 4625). The event includes information about the source IP address, target username, and failure reason.
After several failed attempts, the attacker guesses the correct password for a valid user account.
The system records a successful logon event (Event ID 4624) for the compromised account, originating from the same source IP address as the previous failed attempts, also via a network logon type.
The attacker gains initial access to the target system using the compromised account.
The attacker may then attempt to escalate privileges or move laterally within the network, using the compromised account to access additional resources or systems.

Impact

A successful brute-force attack can lead to unauthorized access to sensitive data, system compromise, and further malicious activities within the network. Compromised accounts can be used to escalate privileges, move laterally, and deploy ransomware. The severity depends on the privileges of the compromised account and the sensitivity of the data it can access.

Recommendation

Enable Audit Logon to generate the necessary events (4624, 4625) in the Windows Security Event Logs for the detection rule to function. Reference: https://ela.st/audit-logon.
Deploy the provided Sigma rule to your SIEM to detect multiple logon failures followed by a successful logon. Tune the rule based on your environment and baseline activity.
Investigate any triggered alerts to determine the scope of the compromise and take appropriate remediation steps.
Consider implementing multi-factor authentication (MFA) to mitigate the risk of brute-force attacks.
Monitor network traffic for suspicious activity originating from the source IP address associated with the brute-force attempts.
Review and enforce strong password policies to reduce the likelihood of successful password guessing.

Signal K Server WebSocket Login Brute-Force Vulnerability

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

Signal K server versions 2.24.0 and earlier are vulnerable to credential brute-forcing via the WebSocket protocol. The vulnerability stems from the lack of rate limiting on the WebSocket login endpoint (/signalk/v1/stream), which allows attackers to bypass the existing HTTP rate limiting mechanism. By establishing a WebSocket connection, an attacker can send an unlimited number of login attempts, effectively bypassing the intended rate limiting defense of 100 attempts per 10 minutes on the HTTP login endpoints. This makes it feasible to conduct dictionary attacks and potentially gain unauthorized access to Signal K servers. Signal K servers are commonly deployed on boat networks.

Attack Chain

Attacker identifies a vulnerable Signal K server.
Attacker establishes a WebSocket connection to ws://server:3000/signalk/v1/stream?subscribe=none.
The server sends a hello message, confirming the connection.
Attacker sends a series of login attempts via WebSocket messages using the following JSON format: {"requestId": "1", "login": {"username": "admin", "password": "guess1"}}.
The server processes each login attempt without rate limiting.
Attacker continues sending login attempts using different password guesses.
If successful, the attacker gains unauthorized access to the Signal K server.

Impact

Successful exploitation of this vulnerability allows attackers to bypass HTTP rate limiting and brute-force credentials to gain unauthorized access to Signal K servers. An attacker can achieve a brute-forcing speed of approximately 20 attempts per second, limited by the bcrypt hashing algorithm. A dictionary attack with 10,000 words can be completed in approximately 8 minutes over a single connection. Since Signal K servers are commonly deployed on boat networks, successful exploitation can lead to unauthorized access to sensitive maritime data.

Recommendation

Monitor network connections to Signal K servers for unusually high rates of WebSocket login attempts. Create a detection rule that triggers when a single IP address sends more than 5 login attempts per second via the WebSocket protocol.
Deploy the Sigma rule Detect High Volume SignalK WebSocket Login Attempts to identify potential brute-force attacks against Signal K servers.
Upgrade Signal K servers to a patched version that includes rate limiting on the WebSocket login endpoint.

Azure AD Failed Authentication Increase

hello@craftedsignal.io — Tue, 02 Jan 2024 15:00:00 +0000

This brief focuses on detecting abnormal increases in failed authentication attempts within Azure Active Directory (Azure AD). An adversary attempting to gain unauthorized access to user accounts or systems often performs brute-force or credential stuffing attacks. These attacks result in a higher-than-normal number of failed sign-in attempts. Monitoring and detecting such increases can provide early warning of potential breaches or compromised accounts. Defenders should investigate any significant spikes in failed authentications as they might indicate malicious activity targeting user accounts or application access. The detection is based on analysis of Azure AD sign-in logs to identify when the number of failed sign-ins increases by 10% or greater, warranting further investigation.

Attack Chain

Initial Access: The attacker attempts to gain initial access through various methods, such as phishing, compromised credentials, or exploiting vulnerabilities.
Credential Stuffing/Brute-Force: The attacker uses lists of known usernames and passwords (credential stuffing) or systematically tries different password combinations (brute-force) against Azure AD accounts.
Authentication Attempts: Each failed authentication attempt is logged within Azure AD sign-in logs, recording details such as username, IP address, and failure reason.
Threshold Exceeded: The number of failed sign-in attempts reaches a threshold, triggering the detection rule based on a 10% or greater increase.
Account Lockout (Potential): Multiple failed authentication attempts may lead to account lockouts, disrupting legitimate user access.
Successful Authentication (Potential): If the attacker guesses the correct credentials, they gain unauthorized access to the target account.
Privilege Escalation/Lateral Movement: After gaining access, the attacker attempts to escalate privileges or move laterally within the network to access sensitive data or systems.
Data Exfiltration/Impact: The attacker exfiltrates sensitive data or causes disruption to services depending on their objectives.

Impact

A successful brute-force or credential stuffing attack can lead to unauthorized access to user accounts, data breaches, and service disruptions. Depending on the compromised account’s privileges, the attacker may gain access to sensitive information, escalate privileges, or move laterally within the organization’s network. The impact could range from minor data leaks to significant financial losses and reputational damage. Early detection and mitigation are crucial to minimize the impact of such attacks.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect increases in failed Azure AD sign-in attempts and tune the threshold (10%) based on your environment (Count: "<10%").
Investigate alerts generated by the Sigma rule to determine the source and scope of the increased failed authentications.
Enforce multi-factor authentication (MFA) for all users to mitigate the risk of credential-based attacks.
Implement account lockout policies to prevent attackers from repeatedly attempting to guess passwords.
Monitor sign-in logs for unusual patterns, such as sign-ins from unfamiliar locations or devices, to identify potential compromised accounts.

Windows Admin Account Brute Force Detection

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This detection rule, originally created on 2020-08-29 and last updated on 2026-05-04, identifies potential brute-force attempts against Windows systems. It focuses on scenarios where an attacker attempts to guess passwords for multiple accounts containing the term “admin” in their usernames, suggesting an attempt to compromise privileged accounts. The rule aggregates failed logon events to detect this activity. This is important for defenders as successful brute-force attacks can lead to unauthorized access, data breaches, and other malicious activities. The rule leverages Windows Security Event Logs and requires Audit Logon to be enabled.

Attack Chain

The attacker attempts to gain initial access to the target network.
The attacker identifies potential target accounts with “admin” in their username.
The attacker initiates a series of network logon attempts using various password combinations (T1110.001, T1110.003).
The Windows system records failed logon events (Event ID 4625) in the Security Event Logs.
The detection rule aggregates these failed logon events, filtering out known noisy failure codes.
If the number of failed attempts against distinct “admin” accounts from the same source IP within a 60-second window exceeds a threshold (50 attempts against 2 distinct usernames), the rule triggers an alert.
The attacker, if successful, gains unauthorized access to the targeted admin account.
With access to an admin account, the attacker can perform a wide range of malicious activities, including privilege escalation, data exfiltration, and system compromise.

Impact

Successful brute-force attacks on administrator accounts can lead to significant damage. Attackers gaining access can escalate privileges, install malware, access sensitive data, or disrupt critical systems. This can result in data breaches, financial losses, and reputational damage. While specific victim counts are not provided, the rule’s focus on privileged accounts indicates a high potential for severe impact on organizations.

Recommendation

Enable Audit Logon to generate the necessary Windows Security Event Logs. Refer to the setup instructions at https://ela.st/audit-logon.
Deploy the Sigma rule “Detect Windows Admin Account Brute Force” to your SIEM and tune the threshold parameters (failed_auth_count, count_distinct_user_name) for your environment.
Investigate alerts triggered by the Sigma rule, focusing on the source IP address, targeted usernames, and logon failure reason codes.
Review and strengthen password policies to prevent password guessing attacks (T1110).
Monitor network traffic for suspicious logon attempts from external IP addresses to internal systems.