Detection rules › Sigma
Bruteforce via password reset
Detects if a attacker attempts to reset multiple times a user password to perform a bruteforce attack.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1110.001 Brute Force: Password Guessing, T1110.003 Brute Force: Password Spraying |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4723 | An attempt was made to change an account's password. |
| Security-Auditing | Event ID 4724 | An attempt was made to reset an account's password. |
Rule body yaml
title: Bruteforce via password reset
name: bruteforce_password_reset
description: Detects if a attacker attempts to reset multiple times a user password to perform a bruteforce attack.
references:
- https://twitter.com/mthcht/status/1705164058343756005?s=08
tags:
- attack.credential_access
- attack.t1110.001 # brutforce: Password Guessing
- attack.t1110.003 # brutforce: Password spraying
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID:
- 4723 # reset of own user's password
- 4724 # reset of user's password by another user
condition: selection
falsepositives:
- ADFS, DirSync
level: informational
---
title: Bruteforce via password reset Count
status: experimental
correlation:
type: value_count
rules:
- bruteforce_password_reset
group-by:
- TargetSid
timespan: 10m
condition:
gte: 10
field: host
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID:
- 4723
- 4724