Brute Force Attacks Against Active Directory Accounts

Ankit Mehta@Secvyn

•updated Jun 12, 2026•1•0•4

This rule detects potential brute force attacks against Active Directory accounts by identifying multiple failed login attempts (EventID 4625) from the same IP address to the same account within a short time frame (10 failed attempts within 10 minutes).