Detection rules › Splunk

Suspicious Login Failures (Windows Event Log)

Group by
_time, host, user
Source
github.com/anvilogic-forge/armory

Adversaries may use a single or small list of commonly used passwords against the same account in order to acquire valid account credentials. This use case looks for multiple logon failures by user and host, which may indicate a brute force attack

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1110.001 Brute Force: Password Guessing

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4625An account failed to log on.

Rule body yaml

id: '6012.6415'
title: Suspicious Login Failures
description: 'Adversaries may use a single or small list of commonly used passwords
  against the same account in order to acquire valid account credentials. This use
  case looks for multiple logon failures by user and host, which may indicate a brute
  force attack. -- Threat Actor Association: LUCR-3, Scattered Spider (aka. 0ktapus,
  UNC3944), Volt Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM(EventCode=4625) OR "<EventID>4625<"
  | table _time, host, user parent_*, process, process_*, signature_id | bin span=60s
  | stats values(*) as * by _time, host, user |where event_count > 2 '
techniques:
- credential-access:brute force:password guessing
technique_id:
- T1110.001
data_category:
- Windows event logs
references: null

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` TERM(EventCode=4625) OR "<EventID>4625<"

Stage 2: table

| table _time, host, user parent_*, process, process_*, signature_id

Stage 3: bucket

| bin span=60s

Stage 4: stats

| stats values(*) as * by _time, host, user

Stage 5: where

| where event_count > 2

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4625 corpus 15 (splunk 11, chronicle 2, kusto 2)
event_countgt
  • 2 corpus 3 (splunk 3)

Search terms

Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.

StageTerm
1TERM
1"<EventID>4625<"