How to Identify a Brute-Force Attack from Repeated Failed Login Attempts

Quick Answer

A brute-force attack is the best fit for this pattern because the scenario describes repeated failed login attempts from a single IP followed by an eventual successful login, exactly the signature of an attacker systematically trying passwords against one account until one finally works. Distinguishing brute-force from its close relatives comes down to specifics that the scenario does or doesn't mention: a dictionary attack is technically a variant of brute-force that uses a curated list of likely passwords rather than exhausting a full character space, but without any indication that a targeted wordlist was used, the more general description of repeated attempts points to brute-force rather than that narrower variant. A man-in-the-middle attack involves intercepting communications between two parties, which has nothing to do with repeated login attempts appearing in an audit log. A replay attack reuses a previously captured valid credential or session token rather than guessing new ones, so it wouldn't produce a string of failed attempts before success. Password spraying inverts the brute-force pattern by trying a small number of common passwords across many different accounts to avoid lockouts, rather than hammering many passwords against one account, the opposite of what's described here, where the repeated attempts and eventual success are tied to a single account and single source IP. When you see many failures against one account followed by success, default to brute-force unless the scenario specifies a wordlist, multiple targeted accounts, or credential reuse instead.