Detecting Brute-Force Attacks with SIEM Correlation Rules

Quick Answer

Alerting on multiple failed logins for the same account from different source IPs within a short window is the most effective rule here because it targets the specific evasion technique attackers use against service accounts: spreading login attempts across many source IPs so that no single IP crosses a per-source threshold. A correlation rule that only counts failures from one IP would miss this pattern entirely, since each individual IP might only generate a handful of failed attempts, well below any reasonable per-IP alert threshold, even though the account as a whole is under sustained attack. By correlating Event ID 4625 (failed logon) and 4776 (credential validation) around the target account rather than around the source IP, the SIEM shifts its unit of analysis to match the actual attack surface: the account being targeted, not any single origin point. The short time window is what separates a genuine, concentrated brute-force burst from unrelated failed logins that happen to occur over the course of a normal day, such as a few users mistyping passwords. This account-centric, multi-source correlation approach is a recurring pattern in SIEM tuning questions: whenever an attack description involves multiple source IPs or hosts targeting one account or resource, the correct detection logic groups events by the target, not by the source.