Browser LabLD-SPL-LAB-002Medium
Browser LabLD-SPL-LAB-002Medium22 min
Spray or Brute Force?
Two sources are hammering Jisr's VPN portal. Leadership wants a name for what is happening before they choose a response — blocking one source, resetting one account, or forcing a org-wide reset are very different actions. Use stats to let the numbers classify the technique. Do not guess from the word 'failure'.
What you will be able to do
- Use stats count vs dc to separate volume from spread.
- Classify brute force vs password spray from the aggregates.
- Match the response to the technique, not to the alert count.
SIEM OperationLog AnalysisThreat HuntingT1110.003 — Password SprayingT1110.001 — Password Guessing
Sign in to start this lab.
Sign in