SQL Server - Connection attempt using a disabled account

Status: experimental
Severity: medium
Log source: category application, product mssql
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts authenticate to the database using a disabled user accont

Known false positives

Miss configured accounts or scripts

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts
Privilege Escalation	`T1078` Valid Accounts
Stealth	`T1078` Valid Accounts

Telemetry coverage

Provider	Record / event type
MSSQLSERVER	Event ID 18470
MSSQLSERVER	Event ID 33205

Rule body

title: SQL Server - Connection attempt using a disabled account
description: Detects scenarios where an attacker attempts authenticate to the database using a disabled user accont
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0001-Initial%20access/T1078-Valid%20accounts
- https://www.eraofdata.com/sql-server/connectivity/login-failures/
- https://docs.microsoft.com/en-us/previous-versions/sql/sql-server-2008-r2/ms366351(v=sql.105)
tags:
- attack.valid_account
- attack.t1078
author: mdecrevoisier
status: experimental
logsource:
  product: mssql
  category: application
detection:
  selection_basic:
    EventID: 18470

  selection_advanced:
    EventID: 33205
    action_id:
      - LGFL # FAILED_LOGIN_GROUP
      - LGIF # LOGIN FAILED
    class_type: LX # LOGIN
    additional_information|contains: "<state>7</state>" # User account is disabled
  condition: selection_basic or selection_advanced
falsepositives:
- Miss configured accounts or scripts
level: medium

Stages and Predicates

Stage 0: `condition`

selection_basic or selection_advanced

Stage 1: `selection_basic`

selection_basic:
  EventID: 18470

Stage 2: `selection_advanced`

selection_advanced:
  EventID: 33205
  action_id:
    - LGFL
    - LGIF
  class_type: LX
  additional_information|contains: "<state>7</state>"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action_id`	eq	`LGFL` corpus 2 (sigma 2) `LGIF` corpus 2 (sigma 2)	`field:"action_id" kind:eq`
`additional_information`	match	`<state>7</state>`	`field:"additional_information" kind:match value:"<state>7</state>"`
`class_type`	eq	`LX` corpus 2 (sigma 2)	`field:"class_type" kind:eq value:"LX"`

SQL Server - Connection attempt using a disabled account

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_basic

Stage 2: selection_advanced

Indicators

Stage 0: `condition`

Stage 1: `selection_basic`

Stage 2: `selection_advanced`