Brute Force: Credential Stuffing T1110.004

Tactic: Credential Access

Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.

Events covered

2 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 31 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (75 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
sourcetype11eq 11aws:cloudtrail, azure:monitor:aad, gws:reports:login, o365:management:activity, crushftp:sessionlogs
data_stream.dataset9eq 9okta.system, azure.signinlogs, o365.audit
EventType5eq 3, starts_with 3, in 2user.authentication., user.session.start, PasswordLogonInitialAuthUsingPassword, UserLoginFailed
event.category5eq 5authentication
EventID4eq 4ConsoleLogin, 4624, 4625, security.threat.detected
properties.status.errorCode4eq 450126, 50053
action3eq 3failure
aws::eventName3eq 3ConsoleLogin
azure_ad::result_type3in 2, eq 1, ne 1120000, 120002, 120020, 50053
azure_ad::signin_category3in 3NonInteractiveUserSignInLogs, SignInLogs
azure_ad::user_principal_name3is_not_null 3, ne 2
category3eq 2, ends_with 1SignInLogs, signinlogs
event.outcome3eq 3failure
isOutlier3eq 31
properties.authenticationDetails{}.succeeded3eq 3false

Top indicator values (137 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.categoryeq
authentication
531
data_stream.dataseteq
okta.system
448
data_stream.dataseteq
azure.signinlogs
330
EventTypeeq
user.session.start
38
EventTypestarts_with
user.authentication.
38
actioneq
failure
34
aws::eventNameeq
ConsoleLogin
327
azure_ad::signin_categoryin
NonInteractiveUserSignInLogs
33
azure_ad::signin_categoryin
SignInLogs
33
event.outcomeeq
failure
316
isOutliereq
1
328
properties.authenticationDetails{}.succeededeq
false
35
properties.status.errorCodeeq
50126
35
sourcetypeeq
aws:cloudtrail
359
sourcetypeeq
azure:monitor:aad
347
AppDisplayNameeq
Azure Portal
22
ErrorNumbereq
50126
22
Esql.brute_force_typene
other
22
EventIDeq
ConsoleLogin
26
EventTypein
PasswordLogonInitialAuthUsingPassword
22
EventTypein
UserLoginFailed
22
Operationeq
UserLoginFailed
28
Provider_Namein
AzureActiveDirectory
22
Provider_Namein
Exchange
22
Workloadeq
AzureActiveDirectory
231
aws::userAgentne
Mozilla/5.0 (compatible; MSAL 1.0) PKeyAuth/1.0
22
azure_ad::authentication_requirementeq
singleFactorAuthentication
28
azure_ad::result_typein
120000
22
azure_ad::result_typein
120002
22
azure_ad::result_typein
120020
22

Exclusions (22 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
Esql.o365_audit_LogonErrorin
CmsiInterrupt
1
Esql.o365_audit_LogonErrorin
EntitlementGrantsNotFound
1
Esql.o365_audit_LogonErrorin
InvalidReplyTo
1
Esql.o365_audit_LogonErrorin
PasswordResetRegistrationRequiredInterrupt
1
Esql.o365_audit_LogonErrorin
SsoArtifactExpiredDueToConditionalAccess
1
Esql.o365_audit_LogonErrorin
SsoUserAccountNotFoundInResourceTenant
1
Esql.o365_audit_LogonErrorin
UserStrongAuthClientAuthNRequired
1
Esql.o365_audit_LogonErrorin
UserStrongAuthEnrollmentRequired
1
Esql.o365_audit_LogonErrorin
UserStrongAuthExpired
1
okta::actor.idstarts_with
okta
1
properties.autonomousSystemNumberin
12076
1
properties.autonomousSystemNumberin
8068
1
properties.autonomousSystemNumberin
8069
1
properties.autonomousSystemNumberin
8070
1
properties.autonomousSystemNumberin
8075
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 2 rules

Elastic 9 rules

Splunk 12 rules

Kusto 2 rules

YARA-L 3 rules

Panther 3 rules