Aegis
Rule library
// Detection

Authentication failure burst followed by success

A run of failed authentications for one account followed shortly by a success. The classic signature of a guessing attack that eventually landed.

HighInvestigating0alerts raisedSequence
Armed

What this rule does

Rendered from the stored logic, so it cannot drift from what executes.

8+ events where eventType is AUTHENTICATION_FAILURE followed within 60 minutes by eventType is AUTHENTICATION_SUCCESS, same username

{
  "kind": "sequence",
  "then": [
    {
      "op": "eq",
      "field": "eventType",
      "value": "AUTHENTICATION_SUCCESS"
    }
  ],
  "first": [
    {
      "op": "eq",
      "field": "eventType",
      "value": "AUTHENTICATION_FAILURE"
    }
  ],
  "groupBy": "username",
  "minFirst": 8,
  "withinMinutes": 60
}

Revise

Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.

Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city

Alerts raised (0)

What this rule has actually caught.

Never fired

Armed, but nothing in the retained window has matched it.

Rule

Category
Credential Access
ATT&CK tactic
Credential Access
Technique
T1110.001
Kind
Sequence
State
Armed
Created
7d ago
Last changed
7d ago

Firing history

Total alerts
0
First fired
Never
Last fired
Never
Escalated to cases
0
Dismissed benign
0

Related