Detection: Login Failed Attempts
Overview
Detect multiple failed login attempts to a GitHub account. While some failed attempts may be caused by user error, repeated failures can indicate brute force, password spraying, or credential stuffing attacks attempting to gain unauthorized access. Monitoring these events helps identify potential account compromise attempts and strengthen account security.
References:
Usage
Run the detection in your terminal:
powerpipe detection run github_security_log_detections.detection.login_failed_attemptsSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe detection run github_security_log_detections.detection.login_failed_attempts --shareSQL
This detection uses a named query:
select tp_timestamp as timestamp,action as operation,concat('https://github.com/', user) as resource,actor,tp_source_ip as source_ip,tp_id as source_id,*exclude (actor, timestamp)
from github_security_logwhere action = 'user.failed_login'order by tp_timestamp desc;