Windows Repeated Authentication Failures Followed by Success (Brute Force)
This rule detects a sequence of multiple failed login attempts (more than 4) followed by a successful login for the same user on the same hostname within a 15-minute window. It specifically targets Windows login events (event IDs 4625 for failure and 4624 for success) and correlates them with user and asset entity data, focusing on users in the 'Domain Admins' group and assets that are 'Domain Controllers'. This pattern is indicative of a brute-force attack or password guessing attempt that eventually succeeded.
YARA-L
