T1110.003

← All KQL categories

MITRE ATT&CK Technique

T1110.003

5 queries tagged with this technique.
View on MITRE ATT&CK →

• Analytics Rules Detect Successful Login Following Distributed Ssh Brute Force

  Successful SSH login against a host that just weathered a distributed brute-force campaign. Pair with the Act-I hunt to know if the lightning hit anything.

• Analytics Rules / Failed Logins Failed Login Attempts

  3+ failed sign-ins (`ResultType == 50126` — invalid username or password) for the same UPN within a 2-minute window. Written for a demo that pairs with a Logic App to auto-disable or lock the account.

• Analytics Rules / Password Spray Detect Low And Slow Password Spray

  Low-and-slow spray pattern (Storm-0940-shaped): many unique users from the *same* IP in a day, with roughly one failed attempt per user; includes optional legacy-user-agent hints.

• Analytics Rules / Password Spray Detect Wide Low Volume Password Sprays

  Wide, low-volume spray: from a single IP, exactly one failed attempt per user in a day, but against many different users.

• Hunting Hunt Distributed Ssh Brute Force Per Target

  SSH brute-force hunt that pivots on the target host, not the source IP — catches distributed attacks that stay under per-source thresholds by using thousands of IPs.