Suspicious VPN Authentication: Repeated Failures Followed by Success
Detects a sequence of multiple VPN authentication failures from a single IP address followed by a successful authentication within a 10-minute window, which is indicative of a successful credential brute force attack.
Sigma
