Excessive Windows Logon Failures Detection

Subash Ghimire@iamsubashg

•updated Aug 20, 2025•3•1•69

This rule identifies user accounts with more than 5 failed Windows logon attempts due to wrong passwords in the last 10 minutes, indicating possible brute force attempts.