Mirae Asset Securities hacked twice in two days: 3,800 customer account numbers and 35,255 staff records leaked
https://sockanalyst.com/patch-now/mirae-asset-securities-breach

Splunk
index=web (sourcetype=access_combined OR sourcetype="ms:iis:auto" OR sourcetype="aws:waf")
  (uri_path="*login*" OR uri_path="*auth*" OR uri_path="*otp*" OR uri_path="*verify*")
| bin _time span=10m
| stats dc(user) as accounts dc(uri_path) as paths count as reqs values(status) as statuses by _time, src_ip
| where accounts>=20 OR reqs>=200
| sort - accounts
// One source enumerating many accounts on phone/OTP login flows = Mirae-style login abuse; then check what data those responses returned

Sentinel
let window = 30d;
let loginAbuse = W3CIISLog
| where TimeGenerated > ago(window)
| where csUriStem has_any ("login","auth","otp","verify")
| summarize Reqs=count(), Accounts=dcount(csUserName), Statuses=make_set(scStatus) by cIP, bin(TimeGenerated, 10m)
| where Accounts >= 20 or Reqs >= 200;
let bulkGroupware = OfficeActivity
| where TimeGenerated > ago(window)
| where Operation in ("FileDownloaded","FileSyncDownloadedFull","SearchQueryPerformed","MailItemsAccessed")
| summarize Ops=count(), Items=dcount(OfficeObjectId) by UserId, ClientIP, bin(TimeGenerated, 1h)
| where Items > 500;
loginAbuse | extend Signal="login-enumeration" | union (bulkGroupware | extend Signal="bulk-groupware-read")
// Adapt table names to your web/groupware logs; flags login enumeration and mass internal data pulls