Merge pull request #851 from nterl0k/T1110.003_password_spray

Nterl0k - T1110.003 Generic Password Spray Attack
splunk · Jul 23, 2024 · 38aa83d · 38aa83d
2 parents c2106e4 + 421c06d
commit 38aa83d
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/datasets/attack_techniques/T1110.003/generic_password_spray/password_spray_attack.log b/datasets/attack_techniques/T1110.003/generic_password_spray/password_spray_attack.log
diff --git a/datasets/attack_techniques/T1110.003/generic_password_spray/password_spray_attack.yml b/datasets/attack_techniques/T1110.003/generic_password_spray/password_spray_attack.yml
@@ -0,0 +1,12 @@
+author: Steven Dick
+id: 1d46ff6c-4a0e-4084-8975-e367e4e92bba
+date: '2023-10-30'
+description: 'Generic detection of password spray behaviors using CIM datamodel.'
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/generic_password_spray/password_spray_attack.log
+sourcetypes:
+- WinEventLog:Security
+references:
+- https://www.microsoft.com/en-us/security/blog/2020/04/23/protecting-organization-password-spray-attacks/
+- https://github.com/MarkoH17/Spray365