Most Important ShinyHunters Detection 2026: Password Spraying Against PeopleSoft Login Endpoints
This rule detects potential password spraying attacks against PeopleSoft or PeopleTools applications. It monitors for a pattern where a single source IP address generates multiple failed authentication attempts against a variety of distinct user accounts, followed by at least one successful login from the same source IP. This behavior is indicative of an adversary attempting to gain unauthorized access by iterating through a list of usernames with common or guessed passwords.
YARA-L
