Multiple failed logins from a single IP

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Trusted Relationship (T1199)
Severity	Informational

Description

Multiple failed logins were observed in a short period of time from a single external IP.
The IP is not a known identity provider.

Attacker's Goals

Gain initial access to the cloud console.

Investigative actions

Check if the IP is a known IP.
Check if a successful login from the same IP occurred after the failed login attempts.

Variations

Multiple failed logins from an unknown IP

Synopsis

ATT&CK Tactic	Initial Access (TA0001)
ATT&CK Technique	Trusted Relationship (T1199)
Severity	Medium

Description

Multiple failed logins were observed in a short period of time from a single external IP.
The IP is not a known identity provider.
The IP is not a known IP in the organization.
This could indicate on an active brute force attempt.

Attacker's Goals

Gain initial access to the cloud console.

Investigative actions

Check if the IP is a known IP.
Check if a successful login from the same IP occurred after the failed login attempts.