VPN and Remote Access Credential Stuffing / Brute Force
Credential stuffing and brute force against VPN and remote access gateways is a persistent initial access vector for ransomware operators and nation-state actors. NCSC and CISA have repeatedly warned about Fortinet, Cisco ASA/FTD, Ivanti Connect Secure, Palo Alto GlobalProtect, and SonicWall VPN gateways being targeted. Attackers use credential databases from prior breaches and automated tools to test credentials at scale against VPN login portals. Unlike password spraying against M365, VPN credential stuffing often targets a single account at high frequency (bypassing account lockout through IP rotation) or uses a large pool of breached credential pairs. Volt Typhoon (China-nexus) specifically targets small business routers and VPN gateways for SOHO Living-off-the-Land access. Compromised VPN access gives attackers direct network access, bypassing perimeter defences entirely.
// THREAT: VPN / Remote Access Credential Stuffing
// Detects brute force and credential stuffing against VPN authentication
// Sources: CommonSecurityLog (CEF from firewall/VPN appliances), Syslog
// Alert 1: High-volume authentication failures against VPN
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor has_any ("Fortinet", "Cisco", "Palo Alto", "SonicWall", "Pulse Secure", "Ivanti", "Juniper")
| where Activity has_any ("vpn", "ipsec", "ssl-vpn", "remote-access", "authentication")
| where Message has_any ("failed", "failure", "invalid", "rejected", "denied")
or LogSeverity >= 5
| summarize
FailureCount=count(),
UniqueUsers=dcount(DestinationUserName),
TargetUsers=make_set(DestinationUserName),
UniqueSourceIPs=dcount(SourceIP),
SourceIPs=make_set(SourceIP)
by DeviceAddress, DeviceVendor, bin(TimeGenerated, 15m)
| where FailureCount >= 20 or UniqueUsers >= 5
| extend ThreatType = "VPN_CredentialStuffing"
| extend Severity = iff(FailureCount >= 100, "Critical", iff(FailureCount >= 50, "High", "Medium"))
| sort by FailureCount desc;
// Alert 2: Successful VPN connection from previously-failing IP
let VPNFailingIPs = CommonSecurityLog
| where TimeGenerated > ago(24h)
| where Activity has_any ("vpn", "ssl-vpn", "remote-access")
| where Message has_any ("failed", "failure", "invalid", "rejected")
| summarize Failures=count() by SourceIP
| where Failures >= 10
| distinct SourceIP;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where Activity has_any ("vpn", "ssl-vpn", "remote-access")
| where Message has_any ("success", "established", "connected", "authenticated")
| where SourceIP in (VPNFailingIPs)
| project TimeGenerated, SourceIP, DestinationUserName, DeviceVendor,
DeviceAddress, Activity, Message
| extend ThreatType = "VPN_SuccessAfterCredentialStuffing"
| extend Severity = "Critical"Data Sources
Required Tables
False Positives
- Legitimate users with incorrect VPN credentials due to recent password change (brief surge then success with new credentials)
- Misconfigured VPN clients that retry with old credentials on every connection attempt
- Automated backup or monitoring systems with outdated credentials attempting VPN authentication
- Multiple users behind a shared corporate NAT connecting to VPN simultaneously (same source IP, multiple users)
References (5)
Unlock Pro Content
Get the full detection package for THREAT-VPN-CredentialStuffing including response playbook, investigation guide, and atomic red team tests.