Multiple SSL Login Failures

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule detects multiple failed SSL login attempts from a single source IP to a destination IP within a 24-hour period. A threshold of 10 failed attempts is used to identify potential brute-force attacks or credential stuffing against SSL-enabled services.