detection.wiki

Detection rules › Sigma

Brutforce enumeration with non existing users (login)

Status
experimental
Severity
high
Time window
30m
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to enumerate potential existing users, resulting in failed logins with unexisting or invalid accounts.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1110 Brute Force

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4625An account failed to log on.

Rule body yaml

title: Brutforce enumeration with non existing users (login)
name: login_non_existing_user
description: Detects scenarios where an attacker attempts to enumerate potential existing users, resulting in failed logins with unexisting or invalid accounts.
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1110.xxx-Brut%20force
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
tags:
  - attack.credential_access
  - attack.t1110
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    SubStatus: "0xc0000064" # user not found | Failure code can be defined in "Status" or "Substatus" fields. Usually, if Substatus == 0x0, refers to Status.
  filter:
    IpAddress: "%domain_controllers_ips%" # reduce amount of false positives
  condition: selection and not filter
falsepositives:
  - Missconfigured application
level: high

---
title: Brutforce enumeration with non existing users (login) Count
status: experimental
correlation:
  type: value_count
  rules:
    - login_non_existing_user # Referenced here
  group-by:
    - Computer
  timespan: 30m
  condition:
    gte: 20
    field: TargetUserName
level: high

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
  EventID: 4625
  SubStatus: "0xc0000064"

Stage 2: not filter

filter:
  IpAddress: "%domain_controllers_ips%"

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
IpAddresseq%domain_controllers_ips%

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
SubStatuseq
  • 0xc0000064 corpus 2 (sigma 2)