SQL Server - Brutforce enumeration with non existing users (login)

Status: experimental
Severity: high
Time window: 30m
Log source: category application, product mssql
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to enumerate potential existing SQL users, resulting in failed logins with unexisting or invalid accounts.

Known false positives

Missconfigured application

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Telemetry coverage

Provider	Record / event type
MSSQLSERVER	Event ID 33205

Rule body

title: SQL Server - Brutforce enumeration with non existing users (login)
description: Detects scenarios where an attacker attempts to enumerate potential existing SQL users, resulting in failed logins with unexisting or invalid accounts.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1110.xxx-Brut%20force
- https://www.eraofdata.com/sql-server/connectivity/login-failures/
- https://docs.microsoft.com/en-us/previous-versions/sql/sql-server-2008-r2/ms366351(v=sql.105)
tags:
- attack.credential_access
- attack.t1110
author: mdecrevoisier
status: experimental
logsource:
  product: mssql
  category: application
detection:
  selection:
    EventID: 33205
    action_id:
      - LGFL # FAILED_LOGIN_GROUP
      - LGIF # LOGIN FAILED
    class_type: LX # LOGIN
    additional_information|contains:
      - "<state>2</state>" # User ID is not valid
      - "<state>5</state>" # Login not found
  condition: selection | count(server_principal_name) by Computer > 20
  timeframe: 30m
falsepositives:
- Missconfigured application
level: high

Stages and Predicates

Stage 0: `condition`

selection | count(server_principal_name) by Computer > 20

Stage 1: `selection`

selection:
  EventID: 33205
  action_id:
    - LGFL
    - LGIF
  class_type: LX
  additional_information|contains:
    - "<state>2</state>"
    - "<state>5</state>"

Threshold: > 20

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action_id`	eq	`LGFL` corpus 2 (sigma 2) `LGIF` corpus 2 (sigma 2)	`field:"action_id" kind:eq`
`additional_information`	match	`<state>2</state>` `<state>5</state>`	`field:"additional_information" kind:match`
`class_type`	eq	`LX` corpus 2 (sigma 2)	`field:"class_type" kind:eq value:"LX"`