Credential Stuffing via Valid Account Abuse - Geo-Diverse Failed Logins Then Success
This rule detects potentially malicious authentication patterns by correlating multiple failed login attempts across geographically diverse source IPs followed by a successful login from a source IP that has not been seen in the previous 90 days. This pattern is indicative of automated credential stuffing or brute force attacks targeting user accounts.
Splunk (SPL)
