ATT&CK T1110.003 - HTTP Password Spray (Many Users)

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•10

This rule detects HTTP password spray attacks where an attacker attempts to log in to multiple user accounts on a web application using a common password. It specifically looks for HTTP POST requests to a URI containing 'login' and triggers an alert if 30 such requests are observed within 60 seconds, tracked by the destination IP address.