Netskope CASB credential stuffing: repeated failed logins followed by success
This rule detects potential brute force or password spraying activity by identifying a user account that experiences at least 5 login failures followed by a successful login for the same application and source IP address within a one-hour window. This pattern is indicative of an attacker who has successfully guessed credentials after multiple attempts.
Microsoft Sentinel (KQL)
