Cloud user accounts are trusted entities in your systems, making them high-value targets for attackers. User accounts often have access to sensitive information and the ability to perform privileged actions, such as provisioning instances or generating keys. Malicious actors increasingly rely on account takeover (ATO) methods to compromise these accounts, which enables them to manipulate or abuse permissions. Once inside your systems, attackers can escalate their attacks to exploit business-critical applications and exfiltrate valuable data.

Datadog App and API Protection (AAP) provides built-in detection and defense capabilities that help you mitigate account takeover attacks. With Datadog’s application-level telemetry and automated remediation, your teams can proactively detect account abuse and prevent unauthorized access into your systems.

In this post, we’ll look at how to instrument applications for account takeover detection, as well as how Datadog enables you to detect, respond to, and prevent ATO attacks. For detailed setup instructions and advanced configuration options, you can refer to our guide on managing account theft.

Instrument your application for ATO detection

Since ATO attacks target user accounts, effective detection starts with capturing login activity events from application traces. Datadog supports this through both automatic and manual instrumentation. For applications built on supported frameworks like Flask or Node.js, Datadog will automatically instrument login endpoints, capturing events such as successful and failed login attempts. This instrumentation simplifies the setup process and ensures consistent data collection.

For manual or custom instrumentation, your teams can use Datadog’s tracing libraries to capture events for login endpoints. This includes adding user identifiers to application traces, as well as logic for determining whether a user exists in the case of failed login attempts. These instrumentation steps enable Datadog to efficiently monitor all user authentication activity, which sets the foundation for effective ATO detection.

Detect account takeover attacks

ATO attacks are designed to mimic legitimate user behavior, so they’re difficult to detect through network-level monitoring alone. Without visibility into user sessions and authentication flows across application services, you risk overlooking subtle indicators of compromise. Attackers typically start with credentials obtained through phishing or leaked in previous data breaches. With these credentials, they use a range of techniques to take over accounts and avoid detection, including:

• Brute force attacks, where attackers test several passwords against a single user account
• Credential stuffing, where attackers test large lists of stolen username and password pairs across many accounts
• Distributed credential stuffing, where attackers use botnets to distribute attempts across thousands of IPs and randomize HTTP headers, which makes identifying the source of the attack more difficult

If one of these methods succeeds, attackers may immediately exploit the account by stealing personal data or changing account settings. Or, they may retain access without using it immediately, waiting for a suitable moment to take advantage of it.

To detect these common attack patterns, Datadog AAP continuously monitors login activity and flags suspicious behaviors using built-in detection rules. When a rule triggers, Datadog generates a signal with a severity level based on the threat’s urgency. A critical severity indicates a confirmed account compromise, while low severity may indicate unsuccessful attack attempts.

Signals also include the following contextual information to help teams prioritize their response:

• Metadata about the attacker, such as IP address, user agent, and geolocation
• Automatic clustering, which groups related attacker behaviors based on patterns and request attributes
• Trace-level context, which enables your teams to investigate signals down to the exact login attempts
• Targeted or compromised users list, which Datadog correlates with other risks, such as a user logging in from a new geolocation for the first time or performing impossible travel

These detection capabilities enable organizations to respond swiftly to emerging threats and mitigate potential damage from account takeovers.

Respond to account takeover attacks

ATO attacks create a surge in login traffic, which can lead to application latency and even downtime in some cases. They can also unfold quickly and at scale, often before teams have a chance to respond. That’s why Datadog provides several remediation actions that your teams can incorporate into their end-to-end response as soon as an ATO threat is detected. For high-confidence detections, Datadog will automatically block malicious IPs using the in-app WAF or Denylist, which prevents further login attempts.

Blocking IPs automatically serves as an effective first line of defense that can stop an ATO attack in its early stages in many cases. However, not all attacks can be fully mitigated with automated actions. This is especially true in large-scale or highly distributed campaigns where attackers successfully avoid detection by rotating IPs or mimicking legitimate user behavior.

In these cases, Datadog gives your teams the ability to customize their response in order to slow down or disrupt an attack. First, you can manually block attacker IPs temporarily (such as for 12 hours) from a signal’s side panel in order to prevent further attempts and improve control over potential false positive signals. You can also create custom WAF rules based on attacker fingerprints like HTTP headers, which are surfaced through Datadog’s attacker clustering. For example, based on your application’s risk profile, you can customize rules to either redirect attackers to a custom 403 block page or override the 403 response with a 200 or 404 to avoid alerting them to detection.

Prevent future account takeover attacks

While the ability to detect and respond to account takeovers help stop the immediate threat, they are only part of the full ATO response. Once an ATO attack is contained, your teams need to assess the scope of the attack and ensure defenses are prepared for similar threats in the future.

First, you need to identify compromised accounts and assess their impact. After a signal is triggered, you can use Datadog’s signal side panel to isolate which user accounts were successfully compromised. Next, you need to adjust detection and response strategies for future attacks as part of post-incident analysis, which helps refine your security posture. By reviewing attacker attributes—shared HTTP headers, user agents, or behaviors—you can strengthen detection rules, fine-tune blocking conditions, and reduce false positives for the next attack.

For example, you can configure detection rules to automatically export compromised user IDs via a webhook. This data enables your downstream systems to automatically reset passwords, temporarily disable accounts, and enforce step-up authentication on compromised accounts, which helps contain the ATO attack before attackers can take further action.

Mitigate account takeover attacks with confidence

Account takeover attacks are fast-moving, hard to detect, and can harm your organization’s reputation if not mitigated in time. With attackers using a range of ATO techniques, protecting login endpoints requires more than traditional security measures.

Datadog App and API Protection helps stop account takeovers before they escalate and equips your teams to adapt quickly when they do. With comprehensive login instrumentation and built-in automation, Datadog delivers real-time detection and flexible workflows to disrupt attacks early. And when attacks require deeper investigation, Datadog provides the tools to identify the compromised accounts, respond accordingly, and continuously improve your defenses.

Enable Datadog AAP on your login services to get started—see our guide for detailed information about instrumentation, detection rules, response options, and notifications. You can also check out our documentation to learn more about Datadog App and API Protection. If you don’t already have a Datadog account, you can sign up for a free 14-day trial.