T1133 - External Remote Services - Detect VPN Login Abuse

Matt Swann@Mcswann

•updated Jul 27, 2026•10•1•31

This query intends to detect potentially malicious VPN login attempts by categorizing them into either password spray, or brute force / password stuffing attempts. Detection is fully tunable to your environment and observed baseline user behavior.