Brute-force prevention on specific URLs

Yes, you can do anything with iRules :)

If you want a ready-made iRule then I think the request throttling iRule will do it for you, there are variations of it on CodeShare, for example this one:

https://devcentral.f5.com/codeshare?sid=564

Alternatively a custom iRule will need t be developed to watch out for POST requests to your login page and to monitor with the response is a success or fail and then raise a custom ASM vioation if the number of login failures exceed some threshold