Suspicious Brute Force Activity (Failures Only) [2 Variants]
This detection identifies suspicious authentication failure patterns that may indicate brute-force attacks. It detects four common scenarios: - Repeated failed login attempts to a single account from a single IP address. - Distributed login attempts to a single account from multiple IPs. - A single IP address targeting multiple accounts. - Broad-scale attempts involving multiple accounts and multiple IPs in a short timeframe. This rule focuses on failed login attempts only and is intended for early brute-force detection and threat hunting. Note: Consider tuning the TimeWindow (default: 10 minutes) and Threshold (default: 5 attempts) values to reflect your organization’s normal login activity. A more permissive or stricter threshold may be necessary depending on your environment (e.g., high-traffic services, mobile users, VPNs). Includes both a readable union-based version and a compact case()-based variant for performance-conscious deployments.
Microsoft Sentinel (KQL)
