Splunk insights

Credential Stuffing Volume Anomaly

Detect credential stuffing attacks through abnormal bursts of failed login events from single IPs, surges in total failed events, or spikes in unique source IP addresses indicating distributed botnets.

Compromised Account via TLS Fingerprint Correlation

Confirm account compromise by detecting successful logins sharing JA4 TLS fingerprints with high-volume failed login attempts, indicating the same automated tool breached an account.

Authorization Request Probing and DoS

Detect attack surface mapping, vulnerability probing, or denial-of-service attempts through surges in malformed authorization requests with invalid OAuth 2.1 parameters.

Canonical Tenant URL Security Bypass

Identify potential security control bypass or attacker reconnaissance through authentication attempts using the canonical Auth0 tenant URL instead of the configured custom domain.

MFA Push Fatigue Attack

Detect MFA push fatigue attacks where attackers flood users with rapid MFA push notifications hoping the user will approve to stop the harassment.

MFA Factor Reuse for Account Compromise

Identify potential mass account compromise through detection of a single phone number or Guardian app installation registered across multiple user accounts, indicating a single attacker controlling many accounts.