Yes... a AFTER SERVERERROR 1017 Trigger would capture failed login attempts. Look at the documentation.