How do you triage if a brute-force attack succeeded?

(1) Identify successful login (event 4624) following multiple failures (event 4625) from same source IP. (2) Check legitimate use — was the user actually working at that time? Pull sign-in logs from M365/ADFS. (3) Geographic anomaly — login from country user has never used before. (4) Velocity check — was there a legitimate login from another country within hours? Impossible travel = compromised. (5) Post-login activity — what did the account do after login? Database queries? File downloads? Email sent to new addresses? (6) Force password reset, revoke sessions, MFA enrollment. (7) Hunt for other accounts brute-forced by same IP — likely campaign, not isolated incident. (8) Detection: write Sigma rule for 'failed authentication burst followed by success from same IP within 5 minutes'.