Infostealer Credential Access - Multiple Failed Logins then Success
Detects potential credential access attempts indicative of infostealer activity or brute-force attacks, where an account experiences multiple failed login attempts followed by a successful login within a defined timeframe (5 minutes to 8 hours). This pattern suggests an adversary may be using stolen credentials or attempting to brute-force an account.
Microsoft Sentinel (KQL)
