Cross-Cloud Password Spray detection

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


This detection focuses on identifying potential cross-cloud brute force / Password Spray attempts involving Azure and AWS platforms. It monitors sign-in activities within the Azure Portal and AWS ConsoleLogins where brute force attempts are successful on both platforms in a synchronized manner.

Attribute Value
Type Analytic Rule
Solution Multi Cloud Attack Coverage Essentials - Resource Abuse
ID 1f40ed57-f54b-462f-906a-ac3a89cc90d4
Severity Medium
Kind Scheduled
Tactics CredentialAccess
Techniques T1110
Required Connectors AWS, AzureActiveDirectory, BehaviorAnalytics, MicrosoftThreatProtection
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AWSCloudTrail EventName == "ConsoleLogin" ?
SigninLogs ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to Multi Cloud Attack Coverage Essentials - Resource Abuse