SSL VPN password spray ending in success
This rule targets high-volume account failures followed by a successful tunnel or portal authentication on SSL VPNs. It aims to detect password spraying attacks that eventually lead to a successful login, providing causality fields for investigation.
Cortex XDR
