Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1110-brute-force

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects a Slack user account that records more than five failed logins followed by a successful login within the sequence windows.

Strategy

This rule monitors Slack audit logs (source:slack, service:audit-logs-service) using sequence detection grouped by {{@usr.email}}. It first evaluates @evt.name:user_login_failed counts over one hour, then requires @evt.name:user_login within the configured follow-on window so only the failed-then-success pattern raises a signal.

Triage and response

• Review Slack audit entries for {{@usr.email}} around the signal time to confirm whether failed attempts and the successful login share the same client, IP, and user agent.
• Check whether the account recently enrolled or reset a password, which can produce clustered failed attempts before a legitimate success.
• Verify whether multi-factor authentication completed for the successful login event and whether any MFA fatigue or push-deny patterns appear in nearby logs.
• If the activity is unexpected, treat the account as potentially compromised: reset credentials, revoke active sessions per your runbook, and scope for lateral movement or workspace policy changes tied to the same user.

Changelog

• 11 June 2026: Rule created.