Aegis
Rule library
// Detection

Password spray against directory services

One source address failing authentication repeatedly inside a short window, consistent with spraying a common password across many accounts.

HighInvestigating1alerts raisedThreshold
Armed

What this rule does

Rendered from the stored logic, so it cannot drift from what executes.

20+ events where eventType is AUTHENTICATION_FAILURE, grouped by sourceIp, within 15 minutes

{
  "kind": "threshold",
  "count": 20,
  "where": [
    {
      "op": "eq",
      "field": "eventType",
      "value": "AUTHENTICATION_FAILURE"
    }
  ],
  "groupBy": "sourceIp",
  "windowMinutes": 15
}

Revise

Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.

Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city

Alerts raised (1)

What this rule has actually caught.

AlertFindingStatusRiskRaised
ALT-A61185A single external address failed authentication against 24 distinct directory accounts inside twelve minutes.Investigating74

Rule

Category
Credential Access
ATT&CK tactic
Credential Access
Technique
T1110.003
Kind
Threshold
State
Armed
Created
7d ago
Last changed
7d ago

Firing history

Total alerts
1
First fired
7d ago
Last fired
7d ago
Escalated to cases
1
Dismissed benign
0

Related