Multiple Failed Admin Login Attempts on Web Server

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

This rule detects multiple attempts (10 or more within an hour) from a single IP address to access administrative interfaces on a web server. It specifically looks for URI queries containing keywords like 'admin', 'wp-admin', or 'administrator' in W3CIISLog data. Such activity often indicates a brute-force attack or scanning for administrative login pages.