<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-credential-stuffing-attacks
description: >-
  Detect and mitigate credential stuffing attacks targeting authentication
  endpoints. Covers log analysis for anomalous login patterns, Azure AD
  sign-in risk detection, rate limiting enforcement, bot detection signals,
  and breach credential correlation.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - credential-stuffing
  - brute-force
  - azure-ad
  - okta
  - rate-limiting
  - bot-detection
  - identity-protection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1110.004"]
---

# Detecting Credential Stuffing Attacks

## Overview

Credential stuffing uses breached username/password pairs against authentication
endpoints at scale. Unlike brute force (one account, many passwords), credential
stuffing tests many accounts with known credentials — producing a low failure rate
per account that evades traditional lockout thresholds. Detection requires
correlating velocity, source diversity, user-agent patterns, and geographic
anomalies across the authentication surface.

Mode: `[MODE: BLUE]` for detection engineering; `[MODE: RED]` for attack simulation.

MITRE ATT&CK: T1110.004 (Credential Stuffing), T1078 (Valid Accounts)

## Prerequisites

- Azure AD P2 (Identity Protection) or Okta ThreatInsight
- SIEM with authentication log ingestion (Sentinel, Splunk, Elastic)
- WAF with bot detection capabilities (Cloudflare, AWS WAF)
- Python 3.10+ for agent tooling
- Access to authentication logs (Azure Sign-in Logs, Okta System Log)

## Key Concepts

### Attack Indicators

| Indicator | Description | Confidence |
|-----------|-------------|------------|
| High failure rate from distributed IPs | Many IPs, each with few attempts | High |
| Credential pair reuse | Same user:pass tried across services | Critical |
| Abnormal user-agent distribution | Headless browsers, outdated agents | Medium |
| Geographic impossibility | Logins from disparate regions in minutes | High |
| Login velocity spike | 10x+ baseline auth requests per minute | High |
| Success after long dormancy | Account unused for months, sudden login | Medium |
| Residential proxy IP blocks | Rotating IPs from proxy networks | High |

### Azure AD Detection

```powershell
# Query Azure AD Sign-in Logs for stuffing indicators
Connect-MgGraph -Scopes "AuditLog.Read.All"

# Get risky sign-ins flagged as credential stuffing
Get-MgAuditLogSignIn -Filter "riskLevelDuringSignIn eq 'high'" `
  -Top 100 | Where-Object {
    $_.RiskEventTypes_v2 -contains "unfamiliarFeatures" -or
    $_.RiskEventTypes_v2 -contains "anomalousToken"
  } | Select-Object UserPrincipalName, IPAddress, Location, RiskState

# Detect distributed login failures (KQL — Sentinel)
# SigninLogs
# | where ResultType != 0
# | summarize FailureCount=count(), DistinctIPs=dcount(IPAddress),
#     DistinctUsers=dcount(UserPrincipalName) by bin(TimeGenerated, 5m)
# | where DistinctIPs > 50 and DistinctUsers > 20
```

### Okta Detection

```bash
# Query Okta System Log for login anomalies
curl -s -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/logs?filter=eventType+eq+%22user.session.start%22\
+and+outcome.result+eq+%22FAILURE%22&since=$(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%SZ)" \
  | jq '[.[] | {actor: .actor.alternateId, ip: .client.ipAddress,
    geo: .client.geographicalContext, ua: .client.userAgent.rawUserAgent}]'

# Enable Okta ThreatInsight
curl -s -X POST -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  -H "Content-Type: application/json" \
  "https://${OKTA_DOMAIN}/api/v1/threats/configuration" \
  -d '{"action": "audit"}'
```

### Sigma Detection Rule

```yaml
title: Potential Credential Stuffing — Distributed Authentication Failures
id: 7a3c9f21-4e8b-4d2a-b5c1-8f6e3d9a2b7c
status: experimental
description: >-
  Detects distributed authentication failures from multiple source IPs
  targeting multiple user accounts within a short time window.
logsource:
  category: authentication
  product: azure
detection:
  selection:
    ResultType: '50126'
  condition: selection | count(UserPrincipalName) by bin(5m) > 20
  timeframe: 5m
falsepositives:
  - Misconfigured service accounts retrying authentication
  - Password change rollout affecting many users simultaneously
level: high
tags:
  - attack.credential_access
  - attack.t1110.004
```

## Workflow

1. **Baseline** — Establish normal authentication volume, failure rate, IP diversity
2. **Detect** — Alert on deviation from baseline across velocity, geography, user-agent
3. **Correlate** — Cross-reference failed IPs with threat intelligence feeds
4. **Enrich** — Check source IPs against residential proxy / VPN databases
5. **Contain** — Block offending IP ranges at WAF, enable adaptive MFA
6. **Harden** — Deploy CAPTCHA on auth endpoints, enforce rate limiting

### Rate Limiting Configuration

```bash
# Cloudflare WAF rule — rate limit login endpoint
# Expression: http.request.uri.path eq "/api/auth/login" and http.request.method eq "POST"
# Rate: 5 requests per 10 seconds per IP
# Action: Challenge (CAPTCHA)

# AWS WAF rate-based rule
aws wafv2 create-rate-based-statement \
  --name "LoginRateLimit" \
  --rate-limit 100 \
  --aggregate-key-type IP \
  --scope-down-statement '{
    "ByteMatchStatement": {
      "SearchString": "/api/auth/login",
      "FieldToMatch": {"UriPath": {}},
      "PositionalConstraint": "EXACTLY"
    }
  }'
```

## Verification

- [ ] Authentication logs centralized in SIEM with < 5 min latency
- [ ] Baseline authentication metrics established (volume, failure rate, IP count)
- [ ] Sigma/KQL rules deployed for distributed failure detection
- [ ] Rate limiting enforced on all authentication endpoints
- [ ] Bot detection (CAPTCHA, device fingerprinting) active on login
- [ ] Threat intelligence feed correlation for source IPs
- [ ] Adaptive MFA triggered on risky sign-in detection
- [ ] Incident runbook documented for credential stuffing response

## References

- [OWASP Credential Stuffing Prevention](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html)
- [Azure AD Identity Protection Risk Detections](https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks)
- [Okta ThreatInsight](https://help.okta.com/en-us/content/topics/security/threat-insight/ti-index.htm)
- [MITRE ATT&CK T1110.004](https://attack.mitre.org/techniques/T1110/004/)
