Goal

Detect excessive password reset requests from an IP.

This may be caused by a malicious actor trying to use the feature to list existing users, or compromise some.

Required business logic events

Datadog auto-instruments many event types. Review your instrumented business logic events. This detection requires the following instrumented event:

• users.password_reset

Strategy

Count the number of users to which an IP requested password resets.

Require the password reset to be flagged using a user event with a usr.login metadata field set to the user receiving the password reset and a exists field set to true or false whether the user existed or not.

usr.login must be provided and unique, even if the user didn’t exist.

A Medium signal is then generated if more than 5 password resets from a single IP over 5 minutes are found for users that exist. A Low signal is generated if the user didn’t exist.

Triage and response

1. Investigate the IP activity and validate that it is legitimate.
2. Review your password reset process to ensure it’s not leaking whether the user existed or not.
3. Consider blocking the IP to slow down the attacker.