A SIEM correlation rule fires: 'More than 5 failed login attempts followed by a successful login from the same source IP within 2 minutes.' Which attack technique does this rule detect, and what additional context should be collected?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — the brute-force or password-spray followed by successful authentication choice is right because repeated failed logins then success from the same source IP is the classic signature. You should collect the account name, source IP reputation, targeted application, and multi-factor authentication status to see whether the attacker got in and how serious it is.
Full Explanation
The brute-force or password-spray followed by successful authentication choice is correct because repeated failures then success from the same IP is the canonical brute-force or low-and-slow spray signature. Additional context — account name, source IP reputation, application targeted, and whether multi-factor authentication was bypassed or challenged — determines severity and whether the attacker succeeded. The phishing attack choice with email gateway logs is wrong because phishing does not produce this failed-then-success login pattern. The SQL injection choice with web application firewall logs is wrong because SQL injection targets application input fields, not authentication endpoints with repeated login failures. The denial of service choice with bandwidth utilization graphs is wrong because denial of service involves traffic volume, not authentication failure patterns.