Defensive Security (Blue Team) / Detection
Lesson 19 of 32
Writing detections
A good detection looks for attacker behaviour, like many failed logins followed by a success, or a new admin account created at 3am.
Key points
- Many failures then success = possible brute force
- New admin accounts deserve a look
- Tune rules to cut false alarms
Quiz · +10 XP
Which pattern suggests a successful password-guessing attack?
Log in to save progress and earn XP.