Detect VPN and Remote Access Credential Stuffing / Brute Force in Sumo Logic CSE
Credential stuffing and brute force against VPN and remote access gateways is a persistent initial access vector for ransomware operators and nation-state actors. NCSC and CISA have repeatedly warned about Fortinet, Cisco ASA/FTD, Ivanti Connect Secure, Palo Alto GlobalProtect, and SonicWall VPN gateways being targeted. Attackers use credential databases from prior breaches and automated tools to test credentials at scale against VPN login portals. Unlike password spraying against M365, VPN credential stuffing often targets a single account at high frequency (bypassing account lockout through IP rotation) or uses a large pool of breached credential pairs. Volt Typhoon (China-nexus) specifically targets small business routers and VPN gateways for SOHO Living-off-the-Land access. Compromised VPN access gives attackers direct network access, bypassing perimeter defences entirely.
MITRE ATT&CK
- Tactic
- Credential Access Initial Access
Sumo Detection Query
// Alert 1: High-volume VPN authentication failures
(_sourceCategory="network/vpn" OR _sourceCategory="firewall/fortigate" OR _sourceCategory="firewall/cisco/asa" OR _sourceCategory="firewall/cisco/ftd" OR _sourceCategory="firewall/paloalto" OR _sourceCategory="firewall/sonicwall" OR _sourceCategory="vpn/ivanti" OR _sourceCategory="firewall/juniper")
| where (action in ("failure","failed","denied","rejected") or (type in ("vpn","ssl-vpn","ipsec","remote-access","auth")))
| where !(action in ("success","established","connected","authenticated"))
| timeslice 15m
| stats count as FailureCount, dcount(user) as UniqueUsers, dcount(src_ip) as UniqueSourceIPs, values(user) as TargetedUsers by dest_ip, _timeslice
| where FailureCount >= 20 or UniqueUsers >= 5
| if (FailureCount >= 100, "CRITICAL", if (FailureCount >= 50, "HIGH", "MEDIUM")) as Severity
| fields _timeslice, dest_ip, FailureCount, UniqueUsers, UniqueSourceIPs, TargetedUsers, Severity
| sort by FailureCount desc
// Alert 2: Successful VPN login from IP with prior failures
// Step 1 — collect failing IPs (run as subquery or scheduled lookup)
// (_sourceCategory="network/vpn" OR _sourceCategory="firewall/*")
// | where action in ("failure","failed","denied","rejected") and type in ("vpn","ssl-vpn","remote-access")
// | stats count as Failures by src_ip | where Failures >= 10
// Step 2 — join successes against that list
(_sourceCategory="network/vpn" OR _sourceCategory="firewall/fortigate" OR _sourceCategory="firewall/cisco/asa" OR _sourceCategory="firewall/paloalto" OR _sourceCategory="firewall/sonicwall" OR _sourceCategory="vpn/ivanti")
| where action in ("success","established","connected","authenticated") and type in ("vpn","ssl-vpn","remote-access")
| lookup Failures from path://"/shared/VPN_FailingIPs" on src_ip
| where Failures >= 10
| fields _messageTime, src_ip, user, dest_ip, action, type, Failures
| concat("CRITICAL") as SeverityTwo-part detection for VPN credential stuffing in Sumo Logic. Part 1 aggregates authentication failures per destination device over 15-minute windows and alerts on high failure counts or many unique targeted users. Part 2 cross-references successful VPN logins against IPs that previously generated 10+ failures.
Data Sources
Required Tables
False Positives & Tuning
- Automated VPN reconnection loops from mobile devices with unstable connectivity
- Large-scale password resets causing waves of authentication failures across the user base
- Vulnerability scanners or network health monitors probing VPN endpoints
- Branch office routers performing scheduled VPN tunnel renegotiations that briefly appear as failures
- Outsourced IT or MSP teams authenticating from shared IP ranges that trigger volume thresholds
Other platforms for THREAT-VPN-CredentialStuffing
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1VPN Credential Stuffing Simulation via Python Requests
Expected signal: VPN authentication logs record multiple failures (error: invalid credentials) for multiple usernames from the test IP within the 15-minute window.
Unlock Pro Content
Get the full detection package for THREAT-VPN-CredentialStuffing including response playbook, investigation guide, and atomic red team tests.