Windows Repeated Authentication Failures Before Successful Login

Google SecOps@GoogleSecOps

•updated Jun 2, 2025•1•0•43

This rule detects a pattern of multiple failed login attempts followed by a successful login for the same user on the same hostname within a 15-minute window. This behavior is indicative of a brute-force attack or password guessing attempt that eventually succeeded.