Brutforce enumeration with non existing users (login)

title: Brutforce enumeration with non existing users (login)
name: login_non_existing_user
description: Detects scenarios where an attacker attempts to enumerate potential existing users, resulting in failed logins with unexisting or invalid accounts.
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1110.xxx-Brut%20force
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
tags:
  - attack.credential_access
  - attack.t1110
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    SubStatus: "0xc0000064" # user not found | Failure code can be defined in "Status" or "Substatus" fields. Usually, if Substatus == 0x0, refers to Status.
  filter:
    IpAddress: "%domain_controllers_ips%" # reduce amount of false positives
  condition: selection and not filter
falsepositives:
  - Missconfigured application
level: high

---
title: Brutforce enumeration with non existing users (login) Count
status: experimental
correlation:
  type: value_count
  rules:
    - login_non_existing_user # Referenced here
  group-by:
    - Computer
  timespan: 30m
  condition:
    gte: 20
    field: TargetUserName
level: high