Repeated password submissions within a single sign-in session (candidate harvest

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

Detects anomalous authentication behavior indicative of an Adversary-in-the-Middle (AiTM) phishing kit. The rule identifies multiple password submission attempts (failures) followed by a successful authentication within a short period, consistent with an attacker testing multiple harvested credentials against an active session.