AN1338: Analytic 1338
Multiple failed login attempts across different users using common password patterns (e.g., 'Welcome2023')
Analyst context for executives and security teams
This analytic describes a macOS-focused signal where many users experience failed login attempts using common password patterns such as “Welcome2023.” For leaders, the practical issue is not the password itself; it is whether identity monitoring can spot broad, low-and-slow guessing activity before it becomes account compromise or operational disruption.
Executive priority
Prioritize this as an identity resilience and SOC readiness question: can the organization prove it collects macOS authentication failures, correlates them across multiple users, and responds when common password patterns appear? This supports access-control assurance, incident triage, and audit evidence around account protection. Because no ATT&CK relationships or tactic mapping were supplied, treat it as a detection validation item rather than a complete risk scenario.
Technical view
Validate whether macOS authentication logs capture failed login events with user, source, timestamp, host, and failure reason. Detection engineering should look for repeated failures across different user accounts where attempted passwords follow common or seasonal patterns. Since the official detection field is not provided, teams should define local thresholds, time windows, and exclusions carefully, then test against known benign sources such as helpdesk activity, enrollment workflows, password resets, and misconfigured services.
Likely telemetry
- macOS authentication failure logs
- User account identifiers associated with failed logins
- Source host, IP address, or device context when available
- Timestamps sufficient for cross-user correlation
- Failure reason or authentication subsystem details
Detection direction
- Confirm macOS login failure events are collected consistently from relevant endpoints.
- Correlate failed attempts across multiple user accounts rather than reviewing each account in isolation.
- Tune for common password-pattern indicators while avoiding exposure of plaintext password values in logs or alerts where policy prohibits it.
- Establish environment-specific thresholds for number of users, number of failures, and time window.
- Review false positives from onboarding, password changes, shared devices, broken saved credentials, and administrative testing.
Mitigation priorities
- Strengthen password policy against common and seasonal patterns.
- Use multi-factor authentication where applicable to reduce risk from guessed credentials.
- Monitor and alert on repeated failed authentication attempts across user populations.
- Apply account lockout or throttling policies carefully to balance protection against denial-of-service risk.
- Ensure incident response playbooks include validation of affected accounts, source systems, and any successful logins following the failure pattern.
Analyst notes and limits
The supplied object is a detection analytic for macOS with a concise behavior description and no official detection logic. Its main value is as a prompt to verify identity telemetry, cross-user correlation, and response procedures for broad failed-login patterns.
No tactics, technique relationships, detailed detection logic, data sources, thresholds, or mitigations were supplied. Local authentication architecture and logging configuration are required to determine actual coverage and alert quality.
Analytic 1338
Multiple failed login attempts across different users using common password patterns (e.g., 'Welcome2023')
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | b830300ba825… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1338Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.