🌙
 

Subscribe to the Taegis™ XDR Documentation RSS Feed at .

Learn more about RSS readers or RSS browser extensions.

Password Spray

detectors


The Password Spray Detector identifies an attempt to steal account credentials by attempting logins using common account names and frequently used passwords. The detector monitors login events from multiple sources (Windows Active Directory, Cloud Authentication, endpoint, and others) and creates an alert when there are a high number of login attempts using multiple usernames from a single IP address during a small time window.

Password Spray Detector

Password Spray Detector

Schema

Auth

Outputs

Alerts pushed to the Secureworks® Taegis™ XDR Alert Database and Secureworks® Taegis™ XDR Dashboard.

MITRE ATT&CK Category

MITRE Enterprise ATT&CK - Credential Access - Password Spraying. For more information, see MITRE Technique T1110.003.

Configuration Options

None

 

On this page: