This rule detects a potential successful SSH brute-force or password-spraying compromise on macOS by correlating a burst of failed SSH authentication attempts with a subsequent successful login on the same host. It leverages macOS Security Events and specifically the sshd authentication messages: multiple failures (e.g., "Failed password for", "Failed keyboard-interactive/pam for", "PAM: authentication error for") followed within a short window (maxspan 15s) by a successful login (e.g., "Accepted <method> for <user> from <ip>"). The detection is performed per host (host.id) using an EQL sequence: at least ten failures within 15 seconds precede a single Accepted event on the same host. The rule reads source IP address and username from the correlated events, enabling validation of whether the same source/different credentials targeted the same account. The integration prerequisite is macOS Security Events, with data fed into the macos.authentication dataset. A high severity and risk score reflect the credential-access and initial-access implications of a confirmed successful login after repeated failures. The included triage, false-positive cautions, and remediation guidance help responders determine if access was legitimate, mitigate active sessions, rotate credentials, review for persistence, and harden SSH configuration (favor key-based auth, restrict with AllowUsers/AllowGroups, disable Remote Login where not needed). The rule also cross-references related detections and provides investigation steps to confirm attribution and scope across hosts.