Tag
Entra ID Excessive Account Lockouts Detected
2 rules 3 TTPsA high volume of failed Microsoft Entra ID sign-in attempts resulting in account lockouts indicates potential brute-force attacks, such as password spraying or credential stuffing, targeting user accounts.
Azure Entra ID MFA TOTP Brute Force Attempted
3 rules 1 TTPIdentifies brute force attempts against Azure Entra multi-factor authentication (MFA) Time-based One-Time Password (TOTP) verification codes, characterized by high-frequency failed attempts for a single user across numerous distinct sessions, potentially indicating programmatic attempts to bypass MFA.
AWS S3 Bucket Enumeration and Brute Force Attempts
2 rules 4 TTPsA high number of failed S3 operations (AccessDenied errors) against a single bucket from a single source address within a short timeframe can indicate attempts to enumerate bucket objects, brute-force object keys, or inflate AWS billing.
Cisco ASA User Account Lockout Detection
2 rules 2 TTPsDetection of user account lockouts on Cisco ASA devices due to excessive failed authentication attempts, potentially indicating brute-force attacks, password spraying, or credential stuffing.
AWS IAM Assume Role Policy Brute Force Attack
1 rule 2 TTPsDetection of brute force attacks against AWS IAM roles by identifying multiple failed AssumeRole attempts using CloudTrail logs, potentially leading to unauthorized access and resource compromise.