Detection rules › Splunk
Suspicious Login Failures (Windows Event Log)
Adversaries may use a single or small list of commonly used passwords against the same account in order to acquire valid account credentials. This use case looks for multiple logon failures by user and host, which may indicate a brute force attack
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4625: An account failed to log on. |
Rule body
id: '6012.6415'
title: Suspicious Login Failures
description: 'Adversaries may use a single or small list of commonly used passwords
against the same account in order to acquire valid account credentials. This use
case looks for multiple logon failures by user and host, which may indicate a brute
force attack. -- Threat Actor Association: LUCR-3, Scattered Spider (aka. 0ktapus,
UNC3944), Volt Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM(EventCode=4625) OR "<EventID>4625<"
| table _time, host, user parent_*, process, process_*, signature_id | bin span=60s
| stats values(*) as * by _time, host, user |where event_count > 2 '
techniques:
- credential-access:brute force:password guessing
technique_id:
- T1110.001
data_category:
- Windows event logs
references: null
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` TERM(EventCode=4625) OR "<EventID>4625<"
Stage 2: table
| table _time, host, user parent_*, process, process_*, signature_id
Stage 3: bucket
| bin span=60s
Stage 4: stats
| stats values(*) as * by _time, host, user
Stage 5: where
| where event_count > 2
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4625" |
event_count | gt |
| field:"event_count" kind:gt value:"2" |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4625<" |