Detection rules › Splunk
Suspicious Login Failures (Windows Event Log)
Adversaries may use a single or small list of commonly used passwords against the same account in order to acquire valid account credentials. This use case looks for multiple logon failures by user and host, which may indicate a brute force attack
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1110.001 Brute Force: Password Guessing |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4625 | An account failed to log on. |
Rule body yaml
id: '6012.6415'
title: Suspicious Login Failures
description: 'Adversaries may use a single or small list of commonly used passwords
against the same account in order to acquire valid account credentials. This use
case looks for multiple logon failures by user and host, which may indicate a brute
force attack. -- Threat Actor Association: LUCR-3, Scattered Spider (aka. 0ktapus,
UNC3944), Volt Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM(EventCode=4625) OR "<EventID>4625<"
| table _time, host, user parent_*, process, process_*, signature_id | bin span=60s
| stats values(*) as * by _time, host, user |where event_count > 2 '
techniques:
- credential-access:brute force:password guessing
technique_id:
- T1110.001
data_category:
- Windows event logs
references: null
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` TERM(EventCode=4625) OR "<EventID>4625<"
Stage 2: table
| table _time, host, user parent_*, process, process_*, signature_id
Stage 3: bucket
| bin span=60s
Stage 4: stats
| stats values(*) as * by _time, host, user
Stage 5: where
| where event_count > 2
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
event_count | gt |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4625<" |