• Platformchevron right
  • Solutionschevron right
  • Modern NDRchevron right
  • Resourceschevron right
  • Companychevron right

DETECTION OVERVIEW

Spike in AAA Failed Login Attempts

Risk Factors

An attacker with network access to a RADIUS or Diameter server can easily attempt an automated brute force attack to guess passwords. If successful, the attacker can gain access to the network and launch attacks.

The system might change the risk score for this detection.

Kill Chain

Exploitation

Risk Score

60

Next in Exploitation: Spike in Kerberos Revoked Credentials Errors

Attack Background

Authentication, Authorization, and Accounting (AAA) is a security framework implemented in protocols such as RADIUS and Diameter. Before an attacker can gain access to devices, the attacker must first acquire valid credentials. A brute force attack is a method for guessing a weak user password. Brute force attacks can occur manually through trial and error or with automated tools.

Mitigation Options

Establish a throttling policy for failed attempts by implementing lockouts or timeouts
Delay Access-Reject response time to one second to increase attack difficulty
Implement multi-factor authentication
Enforce strong password policies

MITRE ATT&CK ID

What else can RevealX do for you?