This rule detects credential abuse targeting a SonicWall firewall by correlating a burst of failed authentication attempts from a single source IP to a single appliance with subsequent successful remote-access logins from the same source. Specifically, it triggers when there are at least five failed login events affecting at least three distinct user accounts from one source IP to one SonicWall appliance, followed by at least one successful remote-access login after the initial failures. The successful login user need not be among the failed users, as credential testing can enumerate multiple accounts and shared infrastructure may target several accounts. The detection uses ESPL to count failed and successful logins, track unique failed and successful users, record failure and success event codes and timestamps, and compute the time window between the first failure and the last success. The alert maps to MITRE ATT&CK techniques for Brute Force (T1110) with subtechniques Password Guessing (T1110.001), Password Spraying (T1110.003), and Credential Stuffing (T1110.004); as well as Valid Accounts (T1078) and External Remote Services (T1133) under Initial Access and Credential Access. A suppression rule groups alerts by appliance and source IP for 15 minutes to reduce noise. The rule emphasizes that credential-based abuse can utilize shared infrastructure and that the same source IP may repeatedly target multiple accounts. False positives include shared egress addresses, MSPs, help desks, password rotations, or legitimate consecutive failed attempts; such cases should be scoped to the relevant appliance and optional exceptions should be tightly scoped. Remediation steps include disabling affected accounts, terminating sessions, resetting credentials, enforcing MFA, and isolating the source while investigating. Analysts should correlate with VPN sessions, tunnel IPs, downstream activity, and post-authentication changes on the SonicWall appliance to determine impact. The rule is designed for network defense and governance, highlighting the need for strong authentication controls for remote access.