OneLogin OTP Brute Force Attack Detection
This rule detects a successful OneLogin login event that is preceded by multiple failed One-Time Password (OTP) attempts within a 15-minute window for the same user. Specifically, it looks for at least four failed OTP challenges followed by a successful OTP verification and then a successful user login. This pattern is indicative of an OTP brute-force attack where an attacker is attempting to guess the correct OTP.
YARA-L
