Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1110-brute-force

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect a successful brute force attack against an Oracle Fusion application by identifying multiple failed login attempts followed by a successful login from the same user.

Strategy

This rule monitors Oracle Fusion audit logs (source:oracle-fusion and service:oracle-fusion-audit) for USER_LOGIN events. It triggers a Medium severity signal when a user accumulates five or more failed login attempts and then successfully authenticates within a 5-minute window, indicating a likely successful brute-force or credential-stuffing attack.

Triage and Response

1. Identify the affected user {{@usr.name}} and review the full login history for the account.
2. Determine whether the successful login originated from a known or expected IP address and location.
3. Check for any post-authentication activity such as data access, privilege escalation, or configuration changes.
4. If unauthorized access is confirmed, disable the account and revoke active sessions immediately.
5. Escalate to your incident response process and notify the account owner to reset credentials.