title: Authentication Failure
id: a5bd8123-efcd-5b32-b876-d25249e8eb1e
custom_id: wf-auth-001
status: stable
level: medium
description: |
    Detects individual authentication failure events. While a single failure
    may be benign, these events are the building blocks for brute force and
    credential spray correlation rules.
author: WitFoo
date: 2026-02-21
tags:
    - attack.credential_access
    - attack.t1110
references:
    - https://attack.mitre.org/techniques/T1110/
logsource:
    product: witfoo
    service: artifact-exporter
detection:
    selection:
        messageType: "auth_failure"
    condition: selection
fields:
    - clientIP
    - serverIP
    - userName
    - application
    - streamName
    - severityLabel
falsepositives:
    - Forgotten passwords by legitimate users
    - Password rotation causing cached credential failures
    - Service account password expiration