Goal

Detect excessive password reset requests activity.

This may be caused by a malicious actor trying to use the feature to list existing users, or compromise some.

Required business logic events

Datadog auto-instruments many event types. Review your instrumented business logic events. This detection requires the following instrumented event:

• users.password_reset

Strategy

Count the number password reset requests and detect deviations from historical patterns.

Require the password reset to be flagged using either a user event or a custom WAF rule.

A Low signal is then generated if more the password reset requests for a single service over 5 minutes deviates too far from the baseline.

Triage and response

1. Investigate the IP activity over the flagged time window and validate that it is legitimate.
2. Review your password reset process to ensure it’s not leaking whether the user existed or not.
3. Consider blocking the IPs to slow down the attacker.