Brute Force Activity Detected

Information hacker@Informationhacker

•updated Mar 5, 2026•8•0•83

This rule detects brute force activity based on 'BruteForceActivityDetected' events from DeviceEvents. It identifies the attacking IP, the device being attacked, the credential being targeted, the workstation name, domain name, and the type of attack. It then summarizes the count of attacks per unique combination of these fields, ordered by the attack count.