BeyondTrust PRA API High-Volume Mixed-Response Abuse CVE-2026-1731
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
Splunk (SPL)
