Credential Stuffing Attack - High Volume Login Attempts
This rule detects a credential stuffing attack characterized by a high volume of HTTP POST requests to a 'login' URI from a single source IP address within a short timeframe. It specifically looks for HTTP traffic where the method is POST and the URI contains 'login' (case-insensitive). A threshold of 100 such attempts within 60 seconds from the same destination IP address triggers the alert.
Suricata
