Bruteforce via password reset

title: Bruteforce via password reset
name: bruteforce_password_reset
description: Detects if a attacker attempts to reset multiple times a user password to perform a bruteforce attack.
references:
  - https://twitter.com/mthcht/status/1705164058343756005?s=08
tags:
  - attack.credential_access
  - attack.t1110.001 # brutforce: Password Guessing
  - attack.t1110.003 # brutforce: Password spraying
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4723 # reset of own user's password
      - 4724 # reset of user's password by another user
  condition: selection
falsepositives:
  - ADFS, DirSync
level: informational

---
title: Bruteforce via password reset Count
status: experimental
correlation:
  type: value_count
  rules:
    - bruteforce_password_reset
  group-by:
    - TargetSid
  timespan: 10m
  condition:
    gte: 10
    field: host
level: high