Brute Force Login via Windows Security Event 4625
This rule detects potential brute force login attempts against Windows systems by monitoring Windows Security Event ID 4625 (failed logon attempts). It aggregates failed attempts by IP address and computer within a 15-minute window and triggers an alert if the number of failed attempts exceeds a defined threshold (default 10). This indicates an adversary systematically guessing passwords to gain unauthorized access.
Microsoft Sentinel (KQL)
