detection.wiki

Detection rules › Sigma

Brutforce enumeration on Windows OpenSSH server with non existing user

Status
experimental
Severity
high
Time window
30m
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to SSH brutforce a Windows OpenSSH server with non existing users.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1110 Brute Force

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4625An account failed to log on.

Rule body yaml

title: Brutforce enumeration on Windows OpenSSH server with non existing user
name: openssh_bruteforce_non_existing_user
description: Detects scenarios where an attacker attempts to SSH brutforce a Windows OpenSSH server with non existing users.
remarks: This requires to have previously enabled the builtin OpenSSH server or to have installed the "OpenSSH-Win64" component. IpAddress or Workstation fields may be empty. In case Workstation field is not empty, be aware that it may wrongly report the source host. Also note that SSH logins are reported with logon type 8 (clear text). For reliable source IP information, use the logs from the OpenSSH channel, event ID 4.
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1110.xxx-Brut%20force
  - https://winaero.com/enable-openssh-server-windows-10/
  - https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
  - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
tags:
  - attack.credential_access
  - attack.t1110
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    SubStatus: "0xc0000064" # Non existing user
    ProcessName|endswith: '\sshd.exe' # Can be "C:\Program Files\OpenSSH-Win64\sshd.exe" or "C:\Windows\system32\OpenSSH\sshd.exe"
  condition: selection
falsepositives:
  - None
level: high

---
title: Brutforce enumeration on Windows OpenSSH server with non existing user Count
status: experimental
correlation:
  type: value_count
  rules:
    - openssh_bruteforce_non_existing_user # Referenced here
  group-by:
    - Computer
  timespan: 30m
  condition:
    gte: 20
    field: TargetUserName
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 4625
  SubStatus: "0xc0000064"
  ProcessName|endswith: '\sshd.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ProcessNameends_with
  • \sshd.exe corpus 3 (sigma 3)
SubStatuseq
  • 0xc0000064 corpus 2 (sigma 2)