Overview
Failed login patterns are among the most common authentication signals a SOC analyzes. This lesson covers interpreting them.
Learning objectives
- Explain what failed-login patterns can indicate.
- Distinguish attack patterns from benign causes.
- Connect failed logins to detection.
Core concept
Failed logins are authentication attempts that don't succeed. While isolated failures are normal (mistyped passwords), patterns of failures can indicate attacks: brute-force (many failures against one account), password spraying (a few common passwords tried across many accounts to avoid lockouts), and credential stuffing (trying many leaked username/password pairs). The analyst distinguishes these attack patterns from benign causes (a user who forgot their password, a misconfigured service repeatedly failing) using context — the number, rate, spread across accounts, source, and timing of failures, and crucially whether any attempt succeeded. Failed-login analysis is a foundational authentication detection, often the first sign of an attack on credentials.
How it works
Analyzing authentication logs, the analyst looks at failed-login patterns and their shape: many failures on one account in a short time suggests brute-force; a few attempts each across many accounts (staying under lockout thresholds) suggests password spraying; many distinct credential pairs tried suggests credential stuffing (using leaked credentials). Key context: the source (one IP hammering vs distributed), the rate/volume, the spread (one account vs many), the timing (off-hours?), and — most important — whether the pattern is followed by a success (failures then a success from the same source may mean the attack worked → possible compromise, a classic correlation from module 5). Benign explanations (forgotten passwords, a service with stale credentials failing repeatedly, account lockouts) must be ruled out via context. Detections often use correlation rules and thresholds; the analyst validates alerts by examining these patterns. Failed-login analysis is where credential attacks first become visible.
Practical example
The SOC sees an authentication alert. Analyzing the logs, the analyst finds a pattern: a single common password tried once each against dozens of different accounts from one source over a short window — the signature of password spraying (designed to avoid per-account lockout). Checking for success, they find one account's attempt succeeded — a likely compromise. This is very different from the benign case they rule out elsewhere (a single user repeatedly failing their own login, then succeeding — a forgotten password). The failed-login pattern, plus the success, revealed a credential attack that gained access — prompting response on the compromised account.
Cybersecurity relevance
Failed-login patterns are a foundational authentication detection — often the first sign of a credential attack: brute-force (many failures, one account), password spraying (few attempts across many accounts, evading lockout), and credential stuffing (leaked credential pairs). Distinguishing these from benign causes (forgotten passwords, misconfigured services) requires context — volume, rate, spread, source, timing — and, critically, whether a success followed (a classic correlation indicating the attack worked). This connects to SIEM correlation (module 5) and the account-compromise focus of this module. Failed-login analysis makes credential attacks visible early, enabling response before or soon after compromise — core SOC authentication monitoring.
Common mistakes
- Only looking for brute-force (many failures/one account), missing spraying (few attempts/many accounts).
- Not checking whether a failure pattern was followed by a success (the compromise signal).
- Not ruling out benign causes (forgotten passwords, misconfigured services) with context.
Key takeaways
- Failed-login patterns can indicate brute-force (many failures/one account), password spraying (few attempts across many accounts), or credential stuffing (leaked pairs).
- Context (volume, rate, spread, source, timing) distinguishes attacks from benign causes (forgotten passwords, misconfigured services); a success after failures signals likely compromise.
- Failed-login analysis is a foundational authentication detection — often the first sign of a credential attack — connecting to SIEM correlation and account-compromise detection.
Check your understanding
- How do brute-force, password spraying, and credential stuffing differ in their failed-login patterns?
- Why is checking for a success after failures critical, and what benign causes must be ruled out?