Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins. Uses statistical analysis on Splunk or raw log data. Use when investigating account takeover campaigns or building detection rules for auth abuse.
Start a fresh conversation. Replace the highlighted placeholders.
Use hunting-credential-stuffing-attacks to analyze authorized [authentication-log dataset] for credential-stuffing indicators and produce findings plus detection-query recommendations. Use only a test or lab environment with appropriate authorization.
Required inputs
[authentication-log dataset]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: hunting-credential-stuffing-attacksdescription: 'Detects credential stuffing attacks by analyzing authentication logs for login velocity anomalies, ASN diversity, password spray patterns, and geographic distribution of failed logins. Uses statistical analysis on Splunk or raw log data. Use when investigating account takeover campaigns or building detection rules for auth abuse. 'domain: cybersecuritysubdomain: security-operationstags: - credential-stuffing- authentication-logs- login-anomaly- asn-analysis- threat-hunting- account-takeoverversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - DE.CM-01- RS.MA-01- GV.OV-01- DE.AE-02mitre_attack: - T1078- T1190- T1059- T1003- T1110mitre_f3: version: '1.1' tactics: - initial-access - positioning techniques: - id: T1110.004 name: 'Brute Force: Credential Stuffing' tactic: initial-access source: attack - id: T1110.003 name: 'Brute Force: Password Spraying' tactic: initial-access source: attack - id: F1006.002 name: 'Account Takeover: Exposed Login Credential' tactic: initial-access source: f3 - id: F1006 name: Account Takeover tactic: initial-access source: f3
Hunting Credential Stuffing Attacks
When to Use
When investigating security incidents that require hunting credential stuffing attacks
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Instructions
Analyze authentication logs to detect credential stuffing by identifying patterns
of distributed login failures, high IP diversity, and suspicious ASN distribution.
import pandas as pd
from collections import Counter
# Load auth logs
df = pd.read_csv("auth_logs.csv", parse_dates=["timestamp"])
# Credential stuffing indicator: many IPs trying few accounts
ip_per_account = df[df["status"] == "failed"].groupby("username")["source_ip"].nunique()
accounts_under_attack = ip_per_account[ip_per_account > 50]