A SIEM analyst creates a detection rule that fires when a user account logs in successfully after 5 or more failed attempts within 10 minutes. What attack does this detect and what are the potential false positive scenarios?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you're looking at failed logins followed by a success, which is the classic pattern of a successful brute-force or password spray attack. The main false positive is a legitimate user who forgot their password, tried several times, then finally typed it correctly.
Full Explanation
The correct answer is the brute-force or password-spraying scenario because failed logins followed by a success is the pattern of a successful brute-force or password spray attack where the attacker eventually guessed the correct password; the main false positive is legitimate users who forgot their password, tried multiple times, then remembered it correctly. The DDoS answer is wrong because DDoS affects service availability; it does not produce a pattern of failed then successful authentication. The SQL injection answer is wrong because SQL injection appears in application/database logs, not authentication event sequences. The malware installation answer is wrong because software installation events are application events, not authentication failure sequences.