Use Case: Identity
Brute force attack detection
12,000 failed logins against a VPN endpoint over 20 minutes from a 47-country botnet. Traditional rate limiting sees nothing. ManySignal sees a coordinated campaign.
When rate limiting isn't enough
Modern brute force attacks are conducted by credential-stuffing toolkits like Snipr, Openbullet, and SilverBullet that can be configured to distribute attempts across thousands of residential proxy IPs, manage cookie rotations, and handle CAPTCHA solving via third-party services. The resulting attack looks like normal user traffic to per-IP rate limiters.
Detection requires a cross-IP view: counting total attempts against an endpoint or account regardless of source IP, combined with credential pattern analysis that identifies systematic username enumeration or password list structure.
rule: brute_force_distributed
type: aggregation + cross_ip
sources:
- okta / entra_id / ping
- vpn_auth_log (cisco, palo, checkpoint)
- ssh_auth_log (linux syslog)
- windows_rdp_events (4625)
trigger:
- condition: |
failed_auth_count(account OR endpoint) > 50 WITHIN 5m
AND source_ip_count > 10 (distributed indicator)
- OR:
- condition: failed_auth_count(single_ip) > 20 WITHIN 2m
enrichments:
- proxy_detection: ip_type (residential, datacenter, vpn)
- credential_pattern: systematic_username_enum, wordlist_structure
- success_detection: auth_success WITHIN window
mitre: T1110.001 (Brute Force: Password Guessing)How many failed authentication attempts occurred against this account in the detection window?
IdP audit logIs the attack from a single IP or distributed across a botnet?
IP analysisWhat authentication endpoint is being targeted — SSO, VPN, RDP, SSH?
App access logDid the account lock out, and if so, how many times was it unlocked?
AD / Okta eventsHas any attack succeeded — is there a success event after the failure burst?
Event correlationIs the target account a privileged account or a service account?
Identity graphTemporarily block the attacking IP range at the WAF and IdP policy layer
AutonomousIf lockout triggered: require admin unlock with MFA verification before restoring access
AutonomousEnable CAPTCHA or device challenge for the affected endpoint for 4 hours
Approve-gatedIf success detected post-burst: treat as account compromise, escalate immediately
Approve-gatedMITRE ATT&CK mapping
Brute force detection FAQ
Does ManySignal detect distributed brute force from botnets?
Yes. Distributed brute force spreads attempts across hundreds of IPs to avoid per-IP rate limiting. ManySignal's cross-IP correlation identifies the campaign by matching the targeted account, the timing pattern, and the credential structure across all source IPs simultaneously.
What about brute force against SSH and RDP?
SSH and RDP brute force is detected via OS-level authentication logs (auth.log, Windows Security Event 4625). ManySignal normalizes these into the same authentication event model as IdP logs. High-volume SSH brute force also triggers a network-level alert from NetFlow anomaly detection.
Can ManySignal automatically block attacking IPs without analyst approval?
Yes, for IP-level blocks at the WAF or network layer — this is configured as an autonomous action. Account-level actions (lockout, password reset) are approve-gated by default to prevent locking out legitimate users who happen to share a NAT exit IP with the attacker.
What threshold separates a brute force detection from a user who forgets their password?
A user who forgets their password generates 3-5 failed attempts from a known device within a few minutes, then stops. Brute force generates consistent high-rate attempts from an unusual device or IP, often with systematic credential patterns. The rate, source, and pattern all factor into the classification.
Detect distributed credential attacks across all auth endpoints
Cross-IP correlation and success detection built in. Automated blocking before the attacker succeeds.