Measurable Increase Of Successful Authentications

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•32

This rule detects a measurable increase of successful authentications, specifically when the count of successful sign-ins increases by 10% or greater. This could indicate an adversary attempting to gain access through brute-force, password spraying, or credential stuffing attacks, or potentially an increase in legitimate user activity that needs to be baselined.