Detects repeated SIP REGISTER authentication rejection responses for one or more extensions from a client to a VoIP server within five minutes. It distinguishes brute-force or password-spraying attempts from normal digest-auth flows by requiring either 10+ failures on a single extension or 25+ total failures across at least five distinct extensions (with at least five extensions repeatedly failing). The rule reads decoded SIP headers and response codes from network traffic, across both current and legacy SIP schemas, via ES|QL JSON_EXTRACT. It aggregates per time window (5 minutes), client IP, server IP, and extension to compute total_failures, max_failures_per_extension, distinct_extensions, repeated_extensions, and a sample of extensions. The alert is triggered when thresholds are met, flagging potential credential abuse leading to rogue endpoint registration for toll fraud, interception, or hijacking. Includes triage steps (validate client/server, examine credentials, correlate with calls/registrations), false positives (misconfigurations, NAT gateways, proxies), and remediation guidance (block/rate-limit offending IPs at SBC, rotate extension passwords, audit registrations, geo-blocking or allowlists). Maps to MITRE ATT&CK T1110 (Brute Force/Password Spraying) under Credential Access.