Password Spray Activity

Rule Info

Name
Password Spray Activity
Author
Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Description
Indicates that a password spray attack has been successfully performed.
Date
2023-09-03 00:00:00
Modified
None
Id
28ecba0a-c743-4690-ad29-9a8f6f25a6f9
Tags
attack.t1110 attack.credential_access DEMO
Type
Community Rule

Rule History

Author
Title
Date
Commit
Ryan Plas
Merge PR #4893 from @ryanplasma - Update Microsoft references URLS
2024-07-02
github-actions[bot]
Merge PR #4891 from @nasbench - Promote older rules status from `experimental` to `test`
2024-07-01
Mark Morowczynski
Merge PR #4423 from @MarkMorow - Add Azure AD Identity Protection Rules
2023-09-06
frack113
Change field name in detection
2023-08-10
Nasreddine Bencherchali
chore: change service name to lowercase
2023-08-08
frack113
Fix to pass the tests
2023-08-08
Mark Morowczynski
Update azure_identity_protectection_anomalous_token.yml
2023-08-07
Mark Morowczynski
Create azure_identity_protectection_anomalous_token.yml
2023-08-07