Burst of failed logons followed by a success from one source

Threat behaviour covered

Password guessing and spraying generate many failed network logons from one source before one succeeds. The query counts failures and successes per source in a short window and flags sources with both.

Detection logic

index=wineventlog source="WinEventLog:Security" (EventCode=4625 OR EventCode=4624) Logon_Type=3
| eval outcome=if(EventCode=4625, "failure", "success")
| bin _time span=15m
| stats count(eval(outcome="failure")) AS failures
        count(eval(outcome="success")) AS successes
        dc(Account_Name) AS accounts
        BY _time, Source_Network_Address
| where failures >= 10 AND successes >= 1
| sort - failures

Data sources

• Windows Security log: event IDs 4625 (failed logon) and 4624 (successful logon), network logon type 3

False positives and tuning

• Misconfigured services or scheduled tasks with an expired password, and shared NAT or jump hosts that aggregate many users behind one address.
• Raise or lower the failure threshold and window to suit your environment.

Limitations

• Field names differ by add-on version; adjust them to your data. A slow, low-volume spray stays under the threshold, so also review failures per account over longer windows.