Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
Browser LabLD-SPL-LAB-002Medium
Browser LabLD-SPL-LAB-002Medium22 min

Spray or Brute Force?

Two sources are hammering Jisr's VPN portal. Leadership wants a name for what is happening before they choose a response — blocking one source, resetting one account, or forcing a org-wide reset are very different actions. Use stats to let the numbers classify the technique. Do not guess from the word 'failure'.

What you will be able to do

  • Use stats count vs dc to separate volume from spread.
  • Classify brute force vs password spray from the aggregates.
  • Match the response to the technique, not to the alert count.
SIEM OperationLog AnalysisThreat HuntingT1110.003Password SprayingT1110.001Password Guessing

Sign in to start this lab.

Sign in