Simulating Cloud Security Threats - Brute Force Login Attempt

Rule

Office 365 Brute Force Login Attempt

Purpose

Detects an unusual condition where one source has 50 authentication failures for the same user within 15 minutes timeframe.

Objective

Detect multiple failed login attempts (brute force).

How to test

1. Use a test system to simulate 50 failed login attempts within a 15-minute window for the same user from the same source.

2. This can be scripted using tools like Hydra, Medusa, or a custom Python script, such as the following:

password, 
    "login": "Sign in" 
} 
  
# Function to simulate a brute force attack 
def brute_force_login(): 
    for i in range(num_attempts): 
        response = requests.post(login_url, data=payload_template, headers=headers) 
         
        # Log the response status 
        if response.status_code == 200: 
            print(f"Attempt {i+1}: Login attempt failed with status 200 (OK) - Incorrect credentials.") 
        else: 
            print(f"Attempt {i+1}: Status Code {response.status_code}") 
         
        # Adding delay between attempts (to avoid hitting rate limits) 
        time.sleep(1) 
  
if __name__ == "__main__": 
    print("Starting brute force login simulation...") 
    brute_force_login() 
    print("Brute force login simulation completed.")