Overview

Cybercriminals increasingly target application login systems using automated attacks designed to compromise legitimate user accounts.

These attacks may involve testing stolen credentials across multiple accounts, repeatedly attempting to access a specific account, or trying the same password against numerous users.

The GAJWAF Credential Stuffing & Account Takeover Playbook provides a structured approach to identifying, containing and recovering from authentication-related attacks while minimizing disruption to legitimate users.

The playbook explains how GAJWAF's account takeover protection analyzes sign-in behavior, identifies suspicious authentication patterns and applies targeted security controls.

The guiding principle is simple: Read the Shape. Tighten for It.

Rather than indiscriminately blocking users or applying overly restrictive login policies, administrators are guided through identifying the specific attack pattern and configuring the appropriate protection.

Understanding the Four Attack Patterns

The playbook explains four common authentication attack scenarios:

1. Credential Stuffing

Attackers attempt to access multiple accounts using stolen or previously exposed credentials.

GAJWAF can identify suspicious behavior involving one client attempting authentication against many accounts and apply configured client-banning thresholds.

2. Single-Account Brute Force

Multiple clients repeatedly attempt to access the same user account.

GAJWAF can apply account-specific protection when failed login attempts exceed configured thresholds.

3. Password Spraying

Attackers attempt the same password across multiple user accounts to avoid triggering conventional per-account lockout controls.

GAJWAF provides configurable detection and protection thresholds for this attack pattern.

4. Suspicious Successful Logins

An authentication attempt succeeds, but the associated activity appears unusual, such as a login from an unexpected location or device.

Such events require investigation and coordination with the application owner to determine whether the account has been compromised.

What You'll Learn

The playbook provides five essential incident-response steps.

Step 1: Identify the Attack Pattern

Learn how to investigate authentication-related security events using the GAJWAF Events and Insights interfaces.

The guide explains how to identify targeted accounts, suspicious clients and authentication patterns to determine the appropriate response.

Step 2: Verify Account Takeover Protection

Ensure that GAJWAF's account takeover protection is enabled and that the affected application is operating in the appropriate enforcement mode.

Configuration Location: Edit Configuration → Detection → Account Takeover Protection

Step 3: Adjust Protection Thresholds

Learn how to configure authentication security controls according to the observed attack pattern.

The guide covers:

  • Limiting failed login attempts across multiple accounts.
  • Protecting individual accounts targeted by distributed attacks.
  • Detecting password-spraying activity.
  • Configuring account protection durations.
  • Supporting applications that use custom username field names.

It also explains why overly aggressive thresholds can unintentionally prevent legitimate users from signing in.

Step 4: Restrict Malicious Sources and Automated Bots

Apply additional security measures when authentication attacks originate from identifiable IP addresses, suspicious networks or distributed botnets.

The playbook covers:

  • Blocking known malicious IP addresses.
  • Applying geographic and network reputation restrictions.
  • Enabling Under-Attack Mode for browser verification.
  • Combining bot challenges with behavioral authentication controls.

These measures help reduce automated login attempts while preserving access for legitimate users.

Step 5: Protect Potentially Compromised Accounts

When suspicious successful logins are identified, coordinate with the application owner to secure affected accounts.

Recommended actions include:

  • Forcing password resets for potentially compromised accounts.
  • Enabling multi-factor authentication where appropriate.
  • Verifying that affected accounts are protected before closing the incident.

Important: GAJWAF monitors authentication behavior without storing or logging user passwords. Credential resets must be performed through the application or its identity management system.

Why This Playbook Matters

Authentication attacks can lead to unauthorized access, account compromise and exposure of sensitive business information.

Following this playbook helps organizations:

  • Identify credential stuffing, brute-force and password-spraying attacks.
  • Apply targeted controls based on observed authentication behavior.
  • Reduce automated login attempts and account takeover risks.
  • Avoid unnecessary lockouts of legitimate users.
  • Combine behavioral detection, client bans and browser verification.
  • Coordinate account recovery with application administrators.
  • Maintain consistent account protection across appropriately configured GAJWAF cluster nodes.

Incident Recovery and Validation

The playbook includes an incident-closure checklist to help security teams confirm that:

  • Suspicious login activity has subsided.
  • Legitimate users can authenticate successfully.
  • Targeted accounts are protected.
  • Potentially compromised accounts have been secured.
  • Temporary protection thresholds have been reviewed.
  • Incident details and response actions have been documented.

An incident-record template is also provided for tracking affected applications, attack patterns, targeted accounts, security changes and recovery actions.

Download the Playbook

Document: GAJWAF Playbook – Credential Stuffing / Account Takeover
Document Version: 1.0
Document Type: Identity Security Incident Response Playbook
Publication: October 2026
Pages: 6
Intended Audience: GAJWAF Security Analysts and Administrators

Attachment: GAJWAF_Playbook_Credential_Stuffing_ATO.pdf

Download the attached PDF for detailed attack identification procedures, account takeover protection settings, mitigation techniques and incident-response checklists.

Related Documentation

For additional guidance, refer to:

  • GAJWAF Playbook – Site Under Active Attack: Respond to broader application-layer attacks beyond authentication systems.
  • GAJWAF Playbook – Tuning the Bot Challenge: Configure browser verification to distinguish legitimate users from automated clients.
  • GAJWAF Features & Configuration Guide: Understand account takeover protection, bot management, geographic restrictions and reputation-based security controls.

Technical Support

For assistance with GAJWAF account takeover protection, authentication security policies or incident response, contact GajShield Technical Support or your authorized GajShield partner.

Website: https://www.gajshield.com

GAJWAF: Different Applications. Different Protection. Shared Risk Intelligence.