hunting-credential-stuffing-attacks

name	hunting-credential-stuffing-attacks
description	Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins. Uses statistical analysis on Splunk or raw log data. Use when investigating account takeover campaigns or building detection rules for auth abuse.
domain	cybersecurity
tags	["hunting","credential","stuffing","attacks"]
subdomain	security-operations
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"]

Hunting Credential Stuffing Attacks

Overview

Cybersecurity skill for hunting credential stuffing attacks. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "hunting credential stuffing attacks"

• "When investigating security incidents that require hunting credential stuffing a"

• "When building detection rules or threat hunting queries for this domain"

• "When SOC analysts need structured procedures for this analysis type"

• When investigating security incidents that require hunting credential stuffing attacks

• When building detection rules or threat hunting queries for this domain

• When SOC analysts need structured procedures for this analysis type

• When validating security monitoring coverage for related attack techniques

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Familiarity with security operations concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. — Identify the specific credential stuffing attacks techniques or indicators to hunt. Map to MITRE ATT&CK tactics/techniques where applicable.