## Use Case 1: Brute Force Attack (Easy)

**Scenario**: An attacker is trying to guess a user's password to gain unauthorized access to the network. This is often the first step in an attack called "Initial Access."

### The Logic
A brute force attack generates a distinct pattern: **Many Failures followed by (potentially) a Success**.

### 1. The Data Sources
*   **Source**: Windows Event Logs (Security) or Linux `/var/log/auth.log` or SSH logs.
*   **Key Fields**:
    *   `Event ID`: 4625 (Failure), 4624 (Success).
    *   `Logon Type`: 3 (Network), 10 (RDP).
    *   `Account Name`: The target user.
    *   `Source IP`: The attacker's IP.

### 2. The Pattern (Signatures)
*   **Standard Brute Force**:
    *   One Source IP targeting One User Account.
    *   High frequency (> 10 failures in 1 minute).
*   **Password Spraying** (Stealthier):
    *   One Source IP targeting *Many* different User Accounts.
    *   Tries "Password123" against User A, then User B, then User C.
    *   Avoids locking out a single account.
*   **Reverse Brute Force**:
    *   Many Source IPs (Botnet) targeting One User Account.

### 3. The SIEM Rule (Pseudocode)
```sql
Alert IF:
    Event = "Failed Login"
    AND
    Count > 20
    AND
    Time_Window = 5 minutes
    AND
    Same Source_IP
```

### 4. Investigation Steps (The Playbook)
When you see this alert, here is your workflow:
1.  **Check the Username**: Does the account exist? Or is it `admin`, `root`, `test`? (Non-existent accounts usually imply an automated script).
2.  **Check the Source IP**: Is it internal or external?
    *   *Internal*: Could be a misconfigured service or script retry. Contact the machine owner.
    *   *External*: Check Threat Intelligence (VirusTotal/AbuseIPDB). Is this a known bad IP?
3.  **Check for Success**: **CRITICAL**. Did they eventually succeed?
    *   Query: `source_ip=Attacker_IP AND action=Success`.
    *   If **NO**: The firewall/account lockout did its job. Block the IP.
    *   If **YES**: **Incident Declared**. The attacker is inside. Reset password immediately, isolate the host, and look for what they did next.

### 5. False Positives
*   User changed their Active Directory password, but their phone is still trying to sync email with the old password.
*   A service account (cron job) with hardcoded credentials failing repeatedly.

### 6. Real World Example
`Oct 21 04:00:01 sshd[123]: Failed password for root from 192.168.1.105 port 4422 ssh2`
`Oct 21 04:00:02 sshd[123]: Failed password for root from 192.168.1.105 port 4422 ssh2`
`Oct 21 04:00:03 sshd[123]: Failed password for root from 192.168.1.105 port 4422 ssh2`
`Oct 21 04:00:04 sshd[123]: Accepted password for root from 192.168.1.105 port 4422 ssh2`
**Verdict**: Successful Brute Force. Priority Critical.