Failed logon burst
Detects a burst of failed Windows logons (Security 4625) against one account from one source address within a short window — brute force or password…
What it detects
Detects a burst of failed Windows logons (Security 4625) against one account from one source address within a short window — brute force or password spraying against a single target account.
MITRE ATT&CK mapping
- T1110Brute Force· Credential Access
False positives and triage
Service accounts with expired passwords and misconfigured scheduled jobs produce repeated failures. Check whether the source is an internal management host before escalating.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 90%. Source: rules/windows/failed_logon_burst.yaml, licensed under the Apache License 2.0.
id: windows.auth.failed_logon_burst
version: 1.0.0
status: stable
severity: high
confidence: 0.9
platforms: [windows]
mitre_techniques: [T1110]
description: |
Detects a burst of failed Windows logons (Security 4625) against one account from one
source address within a short window — brute force or password spraying against a single
target account.
match:
event_category: authentication
event_action: login_failed
event_outcome: failure
threshold:
count: 10
window_seconds: 600
group_by: [source_ip, user_name]
correlation_keys: [source_ip:user_name]
false_positive_guidance: |
Service accounts with expired passwords and misconfigured scheduled jobs produce repeated
failures. Check whether the source is an internal management host before escalating.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.