Failed logon burst
A burst of failed authentication from a single source IP, in ANY log format.
What it detects
A burst of failed authentication from a single source IP, in ANY log format. This is the provider-agnostic brute-force detector: it keys only on the canonical category/outcome (authentication + failure), so it fires on formats that have no dedicated parser — a VPN, an appliance, an identity provider, or a custom app — as long as the generic enrichment mapped the line to a failed login. The platform-specific rules (SSH, Windows 4625, Entra) still fire on the formats they know; this one closes the gap for everything else.
MITRE ATT&CK mapping
- T1110Brute Force· Credential Access
False positives and triage
A misconfigured service or a user hammering a bad saved password also produces failure bursts. The signal is many failures from one source in a short window, especially against multiple accounts or followed by a success (the engine correlates success-after-failure into "brute force likely succeeded"). This rule intentionally overlaps the platform-specific brute-force rules on known formats; the duplicate alerts group into one incident by source IP.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/multi/auth_failure_burst.yaml, licensed under the Apache License 2.0.
id: multi.authentication.failed_logon_burst
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [windows, linux, macos, network, application]
mitre_techniques: [T1110]
description: |
A burst of failed authentication from a single source IP, in ANY log format.
This is the provider-agnostic brute-force detector: it keys only on the
canonical category/outcome (authentication + failure), so it fires on formats
that have no dedicated parser — a VPN, an appliance, an identity provider, or a
custom app — as long as the generic enrichment mapped the line to a failed
login. The platform-specific rules (SSH, Windows 4625, Entra) still fire on the
formats they know; this one closes the gap for everything else.
match:
event_category: authentication
event_outcome: failure
threshold:
count: 10
window_seconds: 600
group_by: [source_ip]
correlation_keys: [source_ip]
false_positive_guidance: |
A misconfigured service or a user hammering a bad saved password also produces
failure bursts. The signal is many failures from one source in a short window,
especially against multiple accounts or followed by a success (the engine
correlates success-after-failure into "brute force likely succeeded"). This rule
intentionally overlaps the platform-specific brute-force rules on known formats;
the duplicate alerts group into one incident by source IP.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.