Multiple Login Failures — Pattern Analysis

What This Means

Analyze patterns of multiple login failures to distinguish between user mistakes, system misconfigurations, and active security attacks across any authentication system.

Example Log

-- Pattern showing multiple failures across platforms:
[Windows] Event 4625: jsmith failed from 10.0.5.142 (3 times in 2 minutes)
[VPN]     Auth failed: jsmith from 73.162.44.12 (wrong password)
[Web App] POST /login 401 for jsmith from 73.162.44.12
[SSH]     Failed password for jsmith from 10.0.5.142

Indicators of Suspicious Activity

• Same account failing across multiple systems simultaneously (compromised credential being tested)
• Login failures clustering around password change or account modification events
• Failures increasing gradually over time (attacker testing rate limit boundaries)
• Pattern of failures at the start of business hours (password expired over weekend)
• Multiple accounts from same department failing (IT change gone wrong vs targeted attack)
• Failures with correct username but wrong password vs non-existent usernames

How to Investigate

1. Establish the timeline — when did failures start and are they ongoing
2. Determine scope — how many accounts, systems, and protocols are affected
3. Classify the pattern — single account/many systems vs many accounts/single system
4. Check for recent IT changes (password policy, certificate renewal, service restart)
5. Contact the affected user(s) to verify if they are experiencing issues
6. Correlate with any active security incidents or threat intelligence alerts

Recommended Mitigations

• Implement centralized authentication monitoring across all platforms
• Set tiered alerting thresholds (low for 5 failures, high for 20, critical for 50+)
• Deploy cross-platform correlation rules in your SIEM
• Automate initial triage with enrichment (user role, location, recent changes)
• Implement self-service password reset to reduce help desk delay
• Create runbooks for common failure scenarios (password expiry, cert issues, lockout)

Related Log Types

Related Attack Patterns

Frequently Asked Questions