[Snort-sigs] Rule Needed

Beshoy Atef beshoy.atef88 at yahoo.com
Wed May 16 13:28:46 EDT 2018

Hello Snort Team,

I have came across something that you might be able to help me in,

We had a pen testing project, and we had a recommendations of applying rule to detect password sprays,

What happened is that the pen tester was able to run a script that send multiple sessions to login to multiple machines using the different usernames but with the same password, till he was able to login.

I need a rule that can detect the following:
1) If multiple login sessions was initiated from the same machine -same source ip-  within low time frame.2) It was using different usernames but all used the same password.3) It was not destined to one machine that is why this ip was not locked out.

I would appreciate if you can guide me to get this rule implemented.

Thanks again.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20180516/282c34a4/attachment.html>

More information about the Snort-sigs mailing list