Rapid failed-to-successful authentication retry within 60 seconds (automated adaptation)

Duo Tech@duotech

•updated Jul 8, 2026•4•0•7

This rule detects potential brute force or password guessing attempts by monitoring Windows security logs for instances where a failed logon (Event ID 4625) is followed by a successful logon (Event ID 4624) for the same user on the same host within a 60-second window.