DET0551 Password Guessing via Multi-Source Authentication Failure Correlation

Analytics

Series of authentication failures (Event ID 4625) targeting the same or similar user accounts over time from one or more remote IPs

Data Component	Name	Channel
User Account Authentication (DC0002)	WinEventLog:Security	EventCode=4625

Field	Description
TimeWindow	Defines the period in which multiple failed attempts are aggregated (e.g., 10 minutes)
UsernamePattern	Filter for common account naming conventions, e.g., service accounts or administrator variants
SourceIPThreshold	Limit on unique IPs trying to authenticate against a single account

Repeated failed SSH login attempts followed by a possible success from the same remote host

Data Component	Name	Channel
User Account Authentication (DC0002)	linux:syslog	sshd[pid]: Failed password

Field	Description
PortScope	Can be tuned to non-standard ports if SSH is moved from default
UserScope	Filter high-value or restricted users (e.g., root, service)
AttemptThreshold	Number of consecutive failures before flagging (e.g., >5 in 2 minutes)

Series of failed logins from loginwindow or sshd with repeated usernames or password prompts

Data Component	Name	Channel
User Account Authentication (DC0002)	macos:unifiedlog	authd

Field	Description
AuthMechanism	Local console vs. SSH vs. remote Apple Admin tools
FailurePattern	Use regex to isolate brute force messages among other log noise

Multiple failed sign-in attempts from external sources across many users followed by success from the same IP

Data Component	Name	Channel
User Account Authentication (DC0002)	azure:signinlogs	Sign-in logs

Field	Description
GeoRiskScore	Elevate anomalies from uncommon geolocations
MFAStatus	Elevate logins missing MFA on high-value accounts

Login attempt failures over SNMP, Telnet, or SSH interface, often reflected in logs or syslog events

Data Component	Name	Channel
User Account Authentication (DC0002)	networkdevice:syslog	login failed

Field	Description
InterfaceType	Specify monitoring of Telnet/SSH/SNMP for login activity
FailedAttemptThreshold	How many failures in short succession should trigger alerting

Password guessing attempts against web-based apps (e.g., Dropbox, Google Workspace) reflected in API or sign-in logs

Data Component	Name	Channel
User Account Authentication (DC0002)	GCPAuditLogs:login.googleapis.com	Failed sign-in events

Field	Description
AppContext	Which SaaS apps should be monitored for brute force attempts
EmailPattern	Limit scope to enterprise domains or service accounts