Cloud Console Login from Suspicious IP Range

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects HTTP POST requests to common cloud console login pages (AWS, Microsoft Azure, Google Cloud) that originate from a suspicious IP range. The rule uses a threshold of 5 attempts within 30 seconds from the same source IP to trigger an alert, indicating potential brute-force or credential stuffing attacks against cloud accounts.