Tag
low
advisory
Spike in Successful Logon Events from a Source IP
2 rules 3 TTPsA machine learning job detected a spike in successful authentication events from a source IP address, which can indicate password spraying, user enumeration, or brute force activity, potentially leading to credential access.
credential-access
defense-evasion
brute-force
password-spraying
2r
3t
medium
advisory
Multiple Logon Failure from the Same Source Address
2 rules 2 TTPsDetection of multiple consecutive logon failures from the same source address within a short time interval on Windows systems, indicating potential brute force or password spraying attacks targeting multiple user accounts.
Windows
credential-access
brute-force
password-spraying
2r
2t