Chronicle YARA-L password spray

rule password_spray_4625 { meta: author = "SOC" events: $e.metadata.event_type = "USER_LOGIN" $e.principal.user.userid = $user $e.security_result.action = "BLOCK" | "FAIL" $e.target.asset.hostname = $host match: $user over 5m condition: $e and #user >= 10 }

Google Chronicle YARA-L rule that detects password spraying by grouping failed logons by user in a 5-minute window.

Deploy this rule in Chronicle when your environment sends Windows authentication logs (or cloud identity logs) to the platform and you want continuous spraying detection. The YARA-L rule groups failed logon events by user and counts how many distinct users fail in 5 minutes: the spray pattern (few attempts per account, many accounts) becomes an automatic match. Chronicle runs rules on the real-time stream — the alert reaches the SOAR without anyone watching dashboards. It's the cloud evolution of manual 4625 analysis (BLUE·005).

Don't use it without verifying the UDM mapping of your sources: the rule depends on logon events arriving with metadata.event_type USER_LOGIN and security_result.action FAIL/BLOCK — if your Windows connector doesn't map those fields, the rule never matches. The threshold (#user >= 10 in 5m) needs calibration per environment: networks with constant legitimate failures need higher thresholds or source filters. And watch out: the rule sees volume, not the password — to confirm the spray you need source context and cross-reference with the subsequent successful logon.