Anatomy of a Credential Stuffing Attack

Vectra AI vs.
Microsoft Cloud Attack

As soon as a threat actor gained stolen credentials, it headed straight for our customer’s Microsoft SaaS environment and attempted to log in. But with Vectra Extended Managed Detection and Response (MXDR) in play, the attack didn’t get far.

How Vectra MXDR kept attackers from moving across the SaaS environment

After failing with an initial access attempt, persistent attackers found a way to log in to the customer’s enterprise environment through a VPN. But the Vectra MXDR team quickly escalated the incident before any damage occurred.

The attacker:

Used stolen credentials and attempted to log in
Successfully gained access through a VPN
Moved laterally in the SaaS environment

Defenders know:

When attackers log in through the VPN
Where attackers move laterally
How to take action to escalate and stop the incident

‍

Response time

First Vectra Alert

5:02 A.M

Attack Stopped

5:22 A.M

See and stop credential stuffing attacks in real time

The secret to stopping hybrid attacks that use credential stuffing techniques? Attack Signal Intelligence™. Vectra AI’s patented AI-driven signal empowers defenders leveraging the Vectra AI Platform to move at the speed and scale of modern hybrid attackers.

References in MITRE D3FEND

90%

MITRE ATT&CK coverage

AI threat detection patents

Stop a hybrid attack

Take a self-guided tour to see how the Vectra AI Platform empowers you to stop hybrid attacks before any damage is done.

Take Self-Guided Tour

With Vectra AI, credential stuffing isn’t effective

With 11 references in the MITRE D3FEND framework — more than any other vendor — only Vectra AI provides extended managed detection and response capable of stopping hybrid attacks in minutes. In this instance, Vectra MXDR escalated the incident after multiple threat detections were triggered and prioritized — and stopped the attack before it started.

Azure AD MFA-Failed Suspicious Sign-On

Azure AD Suspicious Sign-on

Azure AD Unusual Scripting Engine Usage

Credential stuffing prioritizing tactics

This real attack was initiated after the attacker gained credentials.
Attackers failed with their first attempt to log in to the environment.
Attack Signal Intelligence prioritized activity when attackers successfully gained access.
Vectra MXDR immediately urged investigation and response, then stepped in and stopped the attack.