A SIEM correlation rule fires: 'More than 5 failed login attempts followed by a successful login from the same source IP within 2 minutes.' Which attack technique does this rule detect, and what additional context should be collected?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the pattern (repeated failures then success from the same IP) is the canonical brute-force or low-and-slow spray signature; additional context — account, IP reputation, application, and MFA status — determines severity and whether the attacker succeeded. A is wrong because phishing does not produce this failed-then-success login pattern.
Full explanation below image
Full Explanation
B is correct because the pattern (repeated failures then success from the same IP) is the canonical brute-force or low-and-slow spray signature; additional context — account, IP reputation, application, and MFA status — determines severity and whether the attacker succeeded. A is wrong because phishing does not produce this failed-then-success login pattern. C is wrong because SQL injection targets application input fields, not authentication endpoints with repeated login failures. D is wrong because DoS involves traffic volume, not authentication failure patterns.