<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Credential Stuffing Detection — API Reference

## SIEM Queries

### Splunk

```spl
# Multi-user failures from single IP
index=auth action=failure
| bin _time span=5m
| stats count dc(user) as unique_users by src_ip _time
| where unique_users > 10

# Distributed attack on single user
index=auth action=failure
| bin _time span=10m
| stats count dc(src_ip) as unique_ips by user _time
| where unique_ips > 5

# Success after many failures (account compromise)
index=auth
| sort _time
| streamstats count(eval(action="failure")) as fail_count by user
| where action="success" AND fail_count > 5
```

### Elastic / KQL

```kql
event.category: "authentication" AND event.outcome: "failure"
| stats count(*) as failures, count_distinct(user.name) as users by source.ip
| where users > 10
```

### Microsoft Sentinel / KQL

```kql
SigninLogs
| where ResultType != 0
| summarize FailureCount=count(), UniqueUsers=dcount(UserPrincipalName) by IPAddress, bin(TimeGenerated, 5m)
| where UniqueUsers > 10
| order by FailureCount desc
```

## Have I Been Pwned API

```bash
# Check if email appears in breaches
curl -s -H "hibp-api-key: API_KEY" \
  "https://haveibeenpwned.com/api/v3/breachedaccount/user@target.com"

# Check password hash (k-anonymity model)
# SHA-1 hash the password, send first 5 chars
HASH=$(echo -n "password" | sha1sum | cut -d' ' -f1 | tr '[:lower:]' '[:upper:]')
PREFIX=${HASH:0:5}
SUFFIX=${HASH:5}
curl -s "https://api.pwnedpasswords.com/range/$PREFIX" | grep "$SUFFIX"
```

## WAF Rate Limiting

| Provider | Method | Docs |
|----------|--------|------|
| Cloudflare | Rate Limiting Rules | `cf api /zones/{id}/rate_limits` |
| AWS WAF | Rate-based rules | `aws wafv2 create-rate-based-rule` |
| Akamai | Bot Manager | Application layer controls |
| Azure WAF | Custom rules with rate limit | ARM template deployment |

## Key Detection Methods

| Method | Data Source | Effectiveness |
|--------|-------------|---------------|
| IP reputation | Threat intel feeds | Medium |
| Behavioral analysis | Login timing/patterns | High |
| Device fingerprinting | Browser/TLS fingerprint | High |
| Breach correlation | HIBP / breach databases | High |
| CAPTCHA challenge | Login page | Medium (bypassed by solvers) |
| Credential hashing | Pwned Passwords API | High |
