Possible Brute-Force attempt

Cortex XDR Analytics Alert Reference by Alert name
Product
Cortex XDR
Last date published
2024-10-08
Category
Analytics Alert Reference
Order
Alert name

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

15 Minutes

Deduplication Period

1 Day

Required Data

  • Requires:
    • XDR Agent

Detection Modules

Identity Analytics

Detector Tags

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

Description

  • This may indicate a brute-force attack.

Attacker's Goals

The attacker attempts to gain access to the accounts.

Investigative actions

Verify any successful authentication by the user account referenced by the alert, as these can indicate the attacker managed to guess the credentials.

Variations

Possible Brute-Force attempt with a successful login and suspicious characteristics

Synopsis

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Description

  • This may indicate a brute-force attack.

Attacker's Goals

The attacker attempts to gain access to the accounts.

Investigative actions

Verify any successful authentication by the user account referenced by the alert, as these can indicate the attacker managed to guess the credentials.