T1110.004 — Credential Stuffing

Tactic: Credential Access · Platforms: Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows

Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials…

Sub-technique of Brute Force (T1110).

Sigma detection rules (9)

title: "T1110.004 Brute Force: Credential Stuffing"
id: 0de56a27-6bed-4aa0-be39-6fbfbd331b89
description: 'Credential Stuffing Detection via Reused Breached Credentials Across Services. (Data Component: User Account Authentication; baseline tier: windows-eventid.) Tune using: UsernameUniquenessThreshold, TimeWindow, SourceIPScope.'
references:
  - https://attack.mitre.org/techniques/T1110/004
author: Shahrukh Khan
date: 2026-01-17
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.004

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: '4625'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  timeframe: 5m

  condition: selection and not filter_system_account | count(TargetUserName) by IpAddress > 5

falsepositives:
  - Shared workstation, jump host, or NAT-egress IP where many legitimate users authenticate and occasionally mistype passwords; tune UsernameUniquenessThreshold and SourceIPScope to the environment's baseline.

level: medium

title: "T1110.004 Brute Force: Credential Stuffing"
id: ee9dfe42-65a8-48b7-ad9e-901840c22dc8
description: 'Credential Stuffing Detection via Reused Breached Credentials Across Services. The prior version matched "Accepted password for" — any single successful login — which has no relationship to stuffing behavior. Automated credential-stuffing tools iterate breached username/password pairs against a target, producing a distinctive volume of failed logins against usernames that do not exist locally ("invalid user"), unlike a legitimate user mistyping their own password. This rule flags that invalid-user failed-auth signal as the base event for downstream burst/aggregation correlation. Tune using: LoginFailureRatio, AuthServiceFilter.'
references:
  - https://attack.mitre.org/techniques/T1110/004
author: Shahrukh Khan
date: 2026-03-24
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.004

logsource:
  product: linux
  service: syslog

detection:
  selection:
    Message|contains: 'Failed password for invalid user'

  condition: selection

falsepositives:
  - A single event only shows one failed attempt against a non-existent local username; confirming genuine credential stuffing still requires correlating many distinct invalid/valid usernames attempted from the same source within a short window against known-breached credential lists, which is a SIEM aggregation layer function, not something this single-event rule can supply.

level: low

title: "T1110.004 Brute Force: Credential Stuffing"
id: ffda75cb-1d1c-422e-886a-73b8ee8f8655
description: 'Credential Stuffing Detection via Reused Breached Credentials Across Services. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DistinctUsernameCount, RemoteAccessFilter.'
references:
  - https://attack.mitre.org/techniques/T1110/004
author: Shahrukh Khan
date: 2026-04-18
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.004

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith: '/sshd'

  condition: selection

falsepositives:
  - Every legitimate SSH session spawns this same parent-child relationship; distinguishing credential stuffing requires distinct-username-count correlation not available at single-event granularity.

level: medium

title: "T1110.004 Brute Force: Credential Stuffing"
id: 00380517-8ab5-41cb-b5e1-e6c06f44eda3
description: 'Credential Stuffing Detection via Reused Breached Credentials Across Services. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: InstanceIDScope, IPBehaviorHistory.'
references:
  - https://attack.mitre.org/techniques/T1110/004
author: Shahrukh Khan
date: 2026-03-19
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.004

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventName: 'ConsoleLogin'
    responseElements.ConsoleLogin: 'Failure'
    additionalEventData.LoginTo|contains: 'signin.aws.amazon.com'

  condition: selection

falsepositives:
  - Users mistyping their password will produce isolated failures, so this rule is only reliable when combined with a repeated-failure count threshold per source IP or per targeted account within a short window.

level: medium

title: "T1110.004 Brute Force: Credential Stuffing"
id: 85b03408-cf6a-4a50-b213-1285694bb756
description: 'Credential Stuffing Detection via Reused Breached Credentials Across Services. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: UserAccountOverlap, FailedAttemptsPerIP.'
references:
  - https://attack.mitre.org/techniques/T1110/004
author: Shahrukh Khan
date: 2026-02-01
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.004

logsource:
  product: saas-app
  service: auth

detection:
  selection:
    event_type: 'login_failure'

  condition: selection

falsepositives:
  - Confirming credential stuffing requires correlating failed logins across many distinct user accounts sharing one source IP within a short time window, which needs aggregation beyond this single-event rule; a misconfigured client retrying stale cached credentials looks similar.

level: medium

title: "T1110.004 Brute Force: Credential Stuffing"
id: cbfb81f4-fe5a-4084-846b-d62f704f5731
description: 'Credential Stuffing Detection via Reused Breached Credentials Across Services. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: BreachedCredentialSourceMatch, SSOServiceScope.'
references:
  - https://attack.mitre.org/techniques/T1110/004
author: Shahrukh Khan
date: 2026-04-17
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.004

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ResultType: '0'
  atrisk:
    RiskState: 'atRisk'
    RiskLevelDuringSignIn: 'high'

  condition: selection and atrisk

falsepositives:
  - Identity Protection risk detections triggered by legitimate but unusual travel or new device patterns.

level: high

title: "T1110.004 Brute Force: Credential Stuffing"
id: ab807156-ee0e-4483-8716-b4105c8ca404
description: 'Credential Stuffing Detection via Reused Breached Credentials Across Services. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: PasswordSourceMatch, MailboxLoginThreshold.'
references:
  - https://attack.mitre.org/techniques/T1110/004
author: Shahrukh Khan
date: 2026-05-27
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.004

logsource:
  product: m365
  service: exchange

detection:
  selection:
    Operation: 'MailboxLogin'

  condition: selection

falsepositives:
  - Mailbox audit records only successful sign-ins, so this rule captures only the post-credential-stuffing access rather than the stuffing attempts themselves.

level: low

title: "T1110.004 Brute Force: Credential Stuffing"
id: c7f1f911-6f9f-4ece-8ac5-19af0f6bd37e
description: 'Credential Stuffing Detection via Reused Breached Credentials Across Services. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: AuthProtocolFilter, FailedAuthBurst.'
references:
  - https://attack.mitre.org/techniques/T1110/004
author: Shahrukh Khan
date: 2026-04-04
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.004

logsource:
  product: networkdevice
  service: syslog

detection:
  selection_radius:
    Message|contains:
      - 'RADIUS'
  selection_tacacs:
    Message|contains: 'TACACS'
  selection_failed:
    Message|contains:
      - 'authentication failed'
      - 'login failure'
      - '%SEC_LOGIN-4-LOGIN_FAILED'
  condition: (selection_radius or selection_tacacs) and selection_failed

falsepositives:
  - Misconfigured client devices repeatedly submitting stale or expired credentials against the AAA server can look similar without a true attack.

level: medium

title: "T1110.004 Brute Force: Credential Stuffing"
id: ba136f89-d5f8-439d-b428-78bec45f5443
description: 'Credential Stuffing Detection via Reused Breached Credentials Across Services. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: PodAccessScope, CredentialSetSize.'
references:
  - https://attack.mitre.org/techniques/T1110/004
author: Shahrukh Khan
date: 2026-04-08
license: MIT
tags:
  - attack.credential-access
  - attack.t1110.004

logsource:
  product: kubernetes
  service: apiserver

detection:
  selection:
    responseStatus.code:
      - 401
      - 403
    objectRef.resource: 'pods'

  condition: selection

falsepositives:
  - Client misconfiguration or expired kubeconfig credentials causing repeated legitimate authorization failures.

level: medium

Related sub-techniques

• T1110.003 Password Spraying
• T1110.001 Password Guessing
• T1110.002 Password Cracking

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1110.004 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan