Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Crowdstrike User with Duplicate Password

The following analytic detects CrowdStrike alerts for non-admin accounts with duplicate password risk, identifying instances where multiple non-admin users share the same password. This practice weakens security and increases the potential for unauthorized access. Addressing these alerts is essential to ensure each user account has a unique, strong password, thereby enhancing overall security and protecting sensitive information.

ATT&CK coverage

Outside the enterprise matrix

T1110Brute Force 91 detections cover this technique

What the source says

What fires this without an attack behind it

No false positives have been identified at this time.

References

https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf

Tagged by the source as

Compromised Windows HostEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.