detection.wiki

Detection rules › Sigma

Brutforce with denied access due to account restrictions policies

Status
experimental
Severity
medium
Time window
30m
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attemps to use a comprimised account but failed to login due to account restrictions policies (permissions, time restrictions, workstation, logon type, ...)

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1078 Valid Accounts

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4625An account failed to log on.

Rule body yaml

title: Brutforce with denied access due to account restrictions policies
name: bruteforce_denied_account_restriction_policies
description: Detects scenarios where an attacker attemps to use a comprimised account but failed to login due to account restrictions policies (permissions, time restrictions, workstation, logon type, ...)
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0001-Initial%20access/T1078-Valid%20accounts
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
tags:
  - attack.privilege_escalation
  - attack.t1078
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    Status: # Failure code can be defined in "Status" or "Substatus" fields. Usually, if Substatus == 0x0, refers to Status.
      - "0xc0000022" # STATUS_ACCESS_DENIED - A process has requested access to an object, but has not been granted those access rights.
      - "0xC0000413" # STATUS_AUTHENTICATION_FIREWALL_FAILED - Account is not allowed to authenticate to the machine
      - "0xC000006E" # STATUS_ACCOUNT_RESTRICTION - Indicates a referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions).
      - "0xC000006F" # STATUS_INVALID_LOGON_HOURS - The user account has time restrictions and cannot be logged onto at this time.
      - "0xC0000070" # STATUS_INVALID_WORKSTATION - The user account is restricted so that it cannot be used to log on from the source workstation.
      - "0xC000015B" # STATUS_LOGON_TYPE_NOT_GRANTED - A user has requested a type of logon (for example, interactive or network) that has not been granted. An administrator has control over who can logon interactively and through the network.
  condition: selection
falsepositives:
  - missconfigured accounts
level: medium

---
title: Brutforce with denied access due to account restrictions policies Count
status: experimental
correlation:
  type: value_count
  rules:
    - bruteforce_denied_account_restriction_policies # Referenced here
  group-by:
    - Computer
  timespan: 30m
  condition:
    gte: 10
    field: EventRecordID
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 4625
  Status:
    - "0xc0000022"
    - "0xC0000413"
    - "0xC000006E"
    - "0xC000006F"
    - "0xC0000070"
    - "0xC000015B"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Statuseq
  • 0xC000006E
  • 0xC000006F corpus 2 (sigma 2)
  • 0xC0000070 corpus 2 (sigma 2)
  • 0xC000015B corpus 2 (sigma 2)
  • 0xC0000413 corpus 2 (sigma 2)
  • 0xc0000022