Brute Force By User

Severity: informational
Log types: Asana.Audit, Atlassian.Audit, AWS.CloudTrail, Box.Event, GSuite.ActivityEvent, Okta.SystemLog, OneLogin.Events, OnePassword.SignInAttempt
Tags: DataModel, Credential Access:Brute Force
Reference: https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks
Source: github.com/panther-labs/panther-analysis

An actor user was denied login access more times than the configured threshold.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Rule body yaml

AnalysisType: rule
Filename: brute_force_by_user.py
RuleID: "Standard.BruteForceByUser"
DisplayName: "Brute Force By User"
Enabled: true
LogTypes:
  - Asana.Audit
  - Atlassian.Audit
  - AWS.CloudTrail
  - Box.Event
  - GSuite.ActivityEvent
  - Okta.SystemLog
  - OneLogin.Events
  - OnePassword.SignInAttempt
Severity: Info
Reports:
  MITRE ATT&CK:
    - TA0006:T1110
Description: An actor user was denied login access more times than the configured
  threshold.
DedupPeriodMinutes: 60
Threshold: 20
Reference: https://owasp.org/www-community/controls/Blocking_Brute_Force_Attacks
Runbook: Analyze the user ID who failed to login, and other actions taken before/after.
  Check if this user eventually authenticated successfully.
SummaryAttributes:
  - p_any_usernames
Tags:
  - DataModel
  - Credential Access:Brute Force
Tests:
  - Name: AWS.CloudTrail - Successful Login
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "IAMUser",
            "principalId": "1111",
            "arn": "arn:aws:iam::123456789012:user/tester",
            "accountId": "123456789012",
            "userName": "testuser",
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "signin.amazonaws.com",
        "eventName": "ConsoleLogin",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "Mozilla",
        "requestParameters": null,
        "responseElements": { "ConsoleLogin": "Success" },
        "additionalEventData":
          {
            "LoginTo": "https://console.aws.amazon.com/console/",
            "MobileVersion": "No",
            "MFAUsed": "No",
          },
        "eventID": "1",
        "eventType": "AwsConsoleSignIn",
        "recipientAccountId": "123456789012",
        "p_log_type": "AWS.CloudTrail",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }
  - Name: AWS.CloudTrail - Failed Login
    ExpectedResult: true
    Mocks:
      - objectName: geoinfo_from_ip
        returnValue: >-
          {
          "ip": "111.111.111.111",
          "region": "UnitTestRegion",
          "city": "UnitTestCityNew",
          "country": "UnitTestCountry",
          "hostname": "somedomain.com",
          "org": "Some Org"
          }
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "IAMUser",
            "principalId": "1111",
            "arn": "arn:aws:iam::123456789012:user/tester",
            "accountId": "123456789012",
            "userName": "tester",
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "signin.amazonaws.com",
        "eventName": "ConsoleLogin",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "Mozilla",
        "requestParameters": null,
        "responseElements": { "ConsoleLogin": "Failure" },
        "additionalEventData":
          {
            "LoginTo": "https://console.aws.amazon.com/console/",
            "MobileVersion": "No",
            "MFAUsed": "No",
          },
        "eventID": "1",
        "eventType": "AwsConsoleSignIn",
        "recipientAccountId": "123456789012",
        "p_log_type": "AWS.CloudTrail",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }
  - Name: Box - Regular Event
    ExpectedResult: false
    Log:
      {
        "type": "event",
        "additional_details": '{"key": "value"}',
        "created_by":
          {
            "id": "12345678",
            "type": "user",
            "login": "cat@example",
            "name": "Bob Cat",
          },
        "ip_address": "111.111.111.111",
        "event_type": "DELETE",
        "p_log_type": "Box.Event",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }
  - Name: Box - Login Failed
    ExpectedResult: true
    Mocks:
      - objectName: geoinfo_from_ip
        returnValue: >-
          {
          "ip": "111.111.111.111",
          "region": "UnitTestRegion",
          "city": "UnitTestCityNew",
          "country": "UnitTestCountry",
          "hostname": "somedomain.com",
          "org": "Some Org"
          }
    Log:
      {
        "type": "event",
        "additional_details": '{"key": "value"}',
        "created_by":
          {
            "id": "12345678",
            "type": "user",
            "login": "cat@example",
            "name": "Bob Cat",
          },
        "event_type": "FAILED_LOGIN",
        "source": { "id": "12345678", "type": "user", "name": "Bob Cat" },
        "ip_address": "111.111.111.111",
        "p_log_type": "Box.Event",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }
  - Name: GSuite - Normal Login Event
    ExpectedResult: false
    Log:
      {
        "id": { "applicationName": "login" },
        "ipAddress": "111.111.111.111",
        "type": "login",
        "name": "login_success",
        "p_log_type": "GSuite.ActivityEvent",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }
  - Name: GSuite - Failed Login Event
    ExpectedResult: true
    Mocks:
      - objectName: geoinfo_from_ip
        returnValue: >-
          {
          "ip": "111.111.111.111",
          "region": "UnitTestRegion",
          "city": "UnitTestCityNew",
          "country": "UnitTestCountry",
          "hostname": "somedomain.com",
          "org": "Some Org"
          }
    Log:
      {
        "actor": { "email": "bob@example.com" },
        "id": { "applicationName": "login" },
        "ipAddress": "111.111.111.111",
        "type": "login",
        "name": "login_failure",
        "p_log_type": "GSuite.ActivityEvent",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }
  - Name: Okta - Successful Login
    ExpectedResult: false
    Log:
      {
        "actor":
          {
            "alternateId": "admin",
            "displayName": "unknown",
            "id": "unknown",
            "type": "User",
          },
        "client": { "ipAddress": "111.111.111.111" },
        "eventType": "user.session.start",
        "outcome": { "reason": "VERIFICATION_ERROR", "result": "SUCCESS" },
        "p_log_type": "Okta.SystemLog",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }
  - Name: Okta - Failed Login
    ExpectedResult: true
    Mocks:
      - objectName: geoinfo_from_ip
        returnValue: >-
          {
          "ip": "111.111.111.111",
          "region": "UnitTestRegion",
          "city": "UnitTestCityNew",
          "country": "UnitTestCountry",
          "hostname": "somedomain.com",
          "org": "Some Org"
          }
    Log:
      {
        "actor":
          {
            "alternateId": "admin",
            "displayName": "unknown",
            "id": "unknown",
            "type": "User",
          },
        "client": { "ipAddress": "111.111.111.111" },
        "eventType": "user.session.start",
        "outcome": { "reason": "VERIFICATION_ERROR", "result": "FAILURE" },
        "p_log_type": "Okta.SystemLog",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }
  - Name: OneLogin - Normal Login Event
    ExpectedResult: false
    Log:
      {
        "event_type_id": 8,
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
        "ipaddr": "111.111.111.111",
        "p_log_type": "OneLogin.Events",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }
  - Name: OneLogin - Failed Login Event
    ExpectedResult: true
    Mocks:
      - objectName: geoinfo_from_ip
        returnValue: >-
          {
          "ip": "111.111.111.111",
          "region": "UnitTestRegion",
          "city": "UnitTestCityNew",
          "country": "UnitTestCountry",
          "hostname": "somedomain.com",
          "org": "Some Org"
          }
    Log:
      {
        "event_type_id": 6,
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
        "ipaddr": "1.2.3.4",
        "p_log_type": "OneLogin.Events",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }
  - Name: GCP - Non Login Event
    ExpectedResult: false
    Log:
      {
        "protoPayload":
          {
            "at_sign_type": "type.googleapis.com/google.cloud.audit.AuditLog",
            "serviceName": "cloudresourcemanager.googleapis.com",
            "methodName": "SetIamPolicy",
            "authenticationInfo": { "principalEmail": "bob@example.com" },
            "requestMetadata": { "callerIP": "111.111.111.111" },
            "serviceData":
              {
                "@type": "type.googleapis.com/google.iam.v1.logging.AuditData",
                "policyDelta":
                  {
                    "bindingDeltas":
                      [
                        {
                          "action": "ADD",
                          "member": "cat@example.com",
                          "role": "roles/resourcemanager.organizationAdmin",
                        },
                      ],
                  },
              },
          },
        "p_log_type": "GCP.AuditLog",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }

  - Name: Asana - Failed Login
    ExpectedResult: true
    Mocks:
      - objectName: geoinfo_from_ip
        returnValue: >-
          {
          "ip": "111.111.111.111",
          "region": "UnitTestRegion",
          "city": "UnitTestCityNew",
          "country": "UnitTestCountry",
          "hostname": "somedomain.com",
          "org": "Some Org"
          }
    Log:
      {
        "actor":
          {
            "actor_type": "user",
            "email": "homer@springfield.com",
            "gid": "2222222",
            "name": "Homer",
          },
        "context": { "client_ip_address": "8.8.8.8", "context_type": "web" },
        "created_at": "2021-10-21T23:38:10.364Z",
        "details": { "method": ["ONE_TIME_KEY"] },
        "event_category": "logins",
        "event_type": "user_login_failed",
        "gid": "222222222",
        "resource":
          {
            "email": "homer@springfield.com",
            "gid": "2222222",
            "name": "homer",
            "resource_type": "user",
          },
        "p_log_type": "Asana.Audit",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }
  - Name: Asana - Normal Login
    ExpectedResult: false
    Log:
      {
        "actor":
          {
            "actor_type": "user",
            "email": "homer@springfield.com",
            "gid": "2222222",
            "name": "Homer",
          },
        "context": { "client_ip_address": "8.8.8.8", "context_type": "web" },
        "created_at": "2021-10-21T23:38:10.364Z",
        "details": { "method": ["ONE_TIME_KEY"] },
        "event_category": "logins",
        "event_type": "user_login_succeeded",
        "gid": "222222222",
        "resource":
          {
            "email": "homer@springfield.com",
            "gid": "2222222",
            "name": "homer",
            "resource_type": "user",
          },
        "p_log_type": "Asana.Audit",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }
  - Name: 1Password - Regular Login
    ExpectedResult: false
    Log:
      {
        "uuid": "1234",
        "session_uuid": "5678",
        "timestamp": "2021-12-03 19:52:52",
        "category": "success",
        "type": "credentials_ok",
        "country": "US",
        "target_user":
          {
            "email": "homer@springfield.gov",
            "name": "Homer Simpson",
            "uuid": "1234",
          },
        "client":
          {
            "app_name": "1Password Browser Extension",
            "app_version": "20184",
            "ip_address": "1.1.1.1",
            "os_name": "Solaris",
            "os_version": "10",
            "platform_name": "Chrome",
            "platform_version": "96.0.4664.55",
          },
        p_log_type: "OnePassword.SignInAttempt",
      }
  - Name: 1Password - Failed Login
    ExpectedResult: true
    Mocks:
      - objectName: geoinfo_from_ip
        returnValue: >-
          {
          "ip": "111.111.111.111",
          "region": "UnitTestRegion",
          "city": "UnitTestCityNew",
          "country": "UnitTestCountry",
          "hostname": "somedomain.com",
          "org": "Some Org"
          }
    Log:
      {
        "uuid": "1234",
        "session_uuid": "5678",
        "timestamp": "2021-12-03 19:52:52",
        "category": "credentials_failed",
        "type": "password_secret_bad",
        "country": "US",
        "target_user":
          {
            "email": "homer@springfield.gov",
            "name": "Homer Simpson",
            "uuid": "1234",
          },
        "client":
          {
            "app_name": "1Password Browser Extension",
            "app_version": "20184",
            "ip_address": "111.111.111.111",
            "os_name": "Solaris",
            "os_version": "10",
            "platform_name": "Chrome",
            "platform_version": "96.0.4664.55",
          },
        "p_log_type": "OnePassword.SignInAttempt",
        "p_parse_time": "2021-06-04 10:02:33.650807",
        "p_event_time": "2021-06-04 09:59:53.650807",
      }

Detection logic

Condition

event_type eq "failed_login"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`event_type`	eq	`failed_login`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)