I'm currently working on a software project as part of a course on Operating Systems Security and one of the features in my project is to detect bruteforce attacks on Windows hosts.
I know that I can easily accomplish this by checking for event ID 4625 and other events in Windows Event Log, but I want that my software works even if Windows Event Log is disabled.
Is there a possibility to do that without using Windows Event Log? Maybe something using Windows API?
This project is in C#, but I don't have problems with C if needed to write some low-level code.