Account Lockout via Repeated Auth Failures - Brute Force or Password Spray

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

Detects Windows accounts that have been locked out due to repeated authentication failures (EventCode 4625 with Status 0xC0000234). The rule summarizes account lockouts by user, tracks source IP addresses to identify potential brute force or password spray activity, and flags whether multiple source IPs were involved in the lockout.