Credential stuffing attack on Jumpcloud

jumpcloud

Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1110-brute-force

Set up the jumpcloud integration.

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect an account take over (ATO) through credential stuffing attack against a Jumpcloud account.

Strategy

To determine a successful attempt: Detect a high number of failed logins from at least seven unique users and at least one successful login for a user within a period of time from the same IP address.

To determine an unsuccessful attempt: Detect a high number of failed logins from at least seven unique users within a period of time from the same IP address.

Triage and response

  1. Determine if it is a legitimate attack or a false positive.
  2. Determine compromised users.
  3. Remediate compromised user accounts.