Rapid Login Attempt - Possible Credential Stuffing

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects a rapid succession of HTTP POST requests to a URI containing 'login' from the same source IP address, indicating a potential credential stuffing or brute-force attack. It triggers an alert if 20 such attempts occur within a 30-second window.