A SIEM analyst creates a detection rule that fires when a user account logs in successfully after 5 or more failed attempts within 10 minutes. What attack does this detect and what are the potential false positive scenarios?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because failed logins followed by a success is the pattern of a successful brute-force or password spray attack where the attacker eventually guessed the correct password; the main false positive is legitimate users who forgot their password, tried multiple times, then remembered it correctly. A is wrong because DDoS affects service availability; it does not produce a pattern of failed then successful authentication.
Full explanation below image
Full Explanation
B is correct because failed logins followed by a success is the pattern of a successful brute-force or password spray attack where the attacker eventually guessed the correct password; the main false positive is legitimate users who forgot their password, tried multiple times, then remembered it correctly. A is wrong because DDoS affects service availability; it does not produce a pattern of failed then successful authentication. C is wrong because SQL injection appears in application/database logs, not authentication event sequences. D is wrong because software installation events are application events, not authentication failure sequences.