Detect failed remote logons against commonly guessed accounts

1title: Detect failed remote logons against commonly guessed accounts2id: 96b89932-c9a8-4ec0-b741-5a9f25b00b093status: experimental4description: |5  Matches a single Security EventID 4625 failure whose target is one of the6  default or generic account names a password-guessing tool tries first, where7  the attempt arrived over the network rather than at the console and failed8  because the password was wrong or the account does not exist. AN1521 defines9  the behaviour as a *series* of failures over a TimeWindow with a10  SourceIPThreshold, and Sigma as this corpus constrains it models neither a11  count nor a window nor a join to the later success — which is why the parent12  T1110 is declined here outright. What one event can still carry is MITRE's13  `UsernamePattern` knob, populated below with generic and default account14  names rather than with anything MITRE supplied, so the rule sees one guess15  and leaves the burst to be recognised by whoever reads the alerts.16  Two clauses do the narrowing. `LogonType` is limited to 3 (network, so SMB17  and WinRM), 8 (network cleartext, so basic-auth web management) and 1018  (RemoteInteractive, so RDP), which drops the console mistype that produces19  most benign 4625s. `SubStatus` is limited to 0xC000006A (bad password) and20  0xC0000064 (no such user), which drops failures caused by lockout, a disabled21  or expired account and logon-hour restrictions — administrative outcomes, not22  guesses. If a collector normalises 4625 without preserving `SubStatus`, that23  clause must be removed or the rule matches nothing.24  The match is exact on `TargetUserName`, not a substring, so `admin1`,25  `administrator2` and localised names such as `administrateur` fall outside it;26  widening the list is the intended tuning direction. 4625 is written by the27  machine that performed the authentication, so guessing against a *domain*28  account is recorded on the domain controller as 4771/4768/4776 instead and is29  invisible here — this rule covers local accounts and the member-server and30  workstation leg only. It is written in the Security channel vocabulary31  (`EventID`, `LogonType`, `SubStatus`, `TargetUserName`) and none of those32  fields carry over to a Sysmon category. Unlike 4688, the audit subcategory33  behind 4625 (*Audit Logon*, Failure) is enabled in the default configuration34  and in the Microsoft and CIS baselines, so no extra policy is needed.35  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0551, not hand-written and not tested by its author. Any lab result is on this rule's own page.36references:37  - https://attack.mitre.org/techniques/T1110/00138  - https://attack.mitre.org/detectionstrategies/DET055139author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)40date: 2026-08-1641tags:42  - attack.credential-access43  - attack.t1110.00144logsource:45  product: windows46  service: security47detection:48  selection:49    EventID: 462550    LogonType:51      - 352      - 853      - 1054    SubStatus:55      - '0xC000006A'56      - '0xC0000064'57    TargetUserName:58      - 'administrator'59      - 'admin'60      - 'guest'61      - 'root'62      - 'sa'63      - 'sysadmin'64      - 'oracle'65      - 'postgres'66      - 'ftp'67      - 'test'68      - 'user'69      - 'backup'70      - 'support'71      - 'demo'72  condition: selection73falsepositives:74  - "A service, scheduled task or mapped drive still holding an old password for a local account named administrator, backup or support. It retries on a timer from one fixed internal address and is the densest recurring source of matches this rule will ever produce, so a source-address allowlist is the first tuning step rather than an optional one."75  - "Authenticated vulnerability scanners and asset-inventory tools sweeping the estate with a credential set that is wrong or expired on a subset of hosts, which produces a burst of LogonType 3 failures against administrator from the scanner's address on every scan schedule."76  - "A help desk engineer mistyping the local administrator password over RDP or WinRM, which writes exactly this event with LogonType 10 or 3 and is indistinguishable from a guess at the single-event level."77  - "Estates that genuinely operate accounts called test, user, backup, support or demo, where every ordinary forgotten password for those users matches. Trim the name list to names that do not exist in your directory before deploying it."78  - "Legacy line-of-business applications authenticating over LogonType 8 with a hard-coded generic account name that was missed in a password rotation, which then fails on every request until someone notices."79level: medium