WordPress brute-force followed by REST API user enumeration from same source

ills3c Intel&Coffee@Ills3C

•updated today•0•0•1

Detects a suspicious sequence where a client IP performs a brute-force attack against WordPress login or XML-RPC endpoints followed by enumeration of the wp-json REST API.