Zscaler ZIdentity - Admin Authentication Brute Force / Credential Stuffing
Detects instances where an administrator account experiences multiple authentication failures within a 15-minute window, followed by a successful authentication attempt from the same client IP address. This pattern is indicative of potential brute force or password spraying activity where the attacker successfully guessed the credentials after multiple failed attempts.
Splunk (SPL)
