VPN login Brute-Force attempt

Cortex XDR Analytics Alert Reference by data source

Product
Cortex XDR
Last date published
2024-12-03
Category
Analytics Alert Reference
Order
data source

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

1 Hour

Deduplication Period

1 Day

Required Data

  • Requires one of the following data sources:
    • Palo Alto Networks Global Protect
      OR
    • Third-Party VPNs

Detection Modules

Identity Analytics

Detector Tags

ATT&CK Tactic

Credential Access (TA0006)

ATT&CK Technique

Brute Force (T1110)

Severity

Low

Description

A user account failed to log in to a VPN service multiple times in a short time period. This may indicate a brute-force attack.

Attacker's Goals

The attacker attempts to gain access to the accounts.

Investigative actions

Verify any successful connections by the user account referenced by the alert, as these can indicate the attacker managed to guess the credentials.