Brute-Force Attack Detection

Attackers can brute-force or spray passwords to discover new accounts to take a hold on, enabling them to extend their control over the AD infrastructure.

When a brute-force is detected, it can mean an attacker is currently active on the network. As soon as this attack is detected, an investigation of its origin needs to be performed and efficiently stopped.

Name: Brute-Force Attack Detection

Codename: C-BAD-PASSWORD-COUNT

Severity: Critical