Detects three or more failed ESXi logins for the same user from the same remote address within ten minutes. The ESXi host’s hostd service logs authentication failures via pam_do_authenticate with rhost (source IP) and login (account). The rule parses these fields using GROK, then counts failures grouped by user.name, source.ip and host.ip. A lookback of ~9 minutes and a threshold of 3 failures within 10 minutes triggers an alert. This behavior is consistent with password guessing attempts targeting a single account from a single source and can precede a successful login. The rule maps to MITRE ATT&CK T1110 (Brute Force / Password Guessing) under Credential Access and is scoped to VMware vSphere logs collected via Elastic’s vSphere integration.