Multiple Failed Logins Followed by Success

Use case development / Detect Unauthorized Access / Detect Brute Force Attacks

sigma

Detection rule

title: Brute Force Followed by Successful Login
status: experimental
description: Detects multiple failed logins followed by success indicating brute force
logsource:
  product: windows
  service: security
detection:
  failed:
    EventID: 4625
  success:
    EventID: 4624
  timeframe: 5m
  condition: failed | count(TargetUserName) by IpAddress > 5 and success
falsepositives:
  - User password reset scenarios
level: high
tags:
  - attack.credential_access
  - attack.t1110

Test cases

• Attempt 10 failed logins then succeed

False positive guidance

Tune threshold and exclude service accounts.

Detection course