Question for people on the latest attacks. Would putting a EULA in front of the username and password input box do anything to prevent some of these scripted processes? Did anyone that dove into the latest vulnerabilities be able to chime in on if even a simple Eula acceptance box do anything to help prevent some of the initial attacks?

We have an EULA check box on the login page that is required to be checked before you can attempt to log on and we saw attempts to compromise ours in the log files. This was after upgrading firmware for the first round of CVEs.

That's good to know. I wonder if it has to be something more than just a Eula, maybe leveraging captcha?

yeah maybe so

We have used the EULA in the past to stop password spraying (temporarily). The attack is usually automated, then starts failing on the EULA page for a few days without the attacker realizing we changed something. It was the change of the login behavior that has helped some break the bots, as other mitigations were created (ie: block some IPs, adjust password lockout policies).

The threat actor is not following the normal login process, but is posting a get request. As such, any times like a EULA or some of my customers direct the user to the second factor first etc. are not going to prevent the threat.