Detect failed remote logons against commonly guessed accounts

Siemphony@siemphonymediumT1110.001unverified

Matches a single Security EventID 4625 failure whose target is one of the default or generic account names a password-guessing tool tries first, where the attempt arrived over the network rather than at the console and failed because the password was wrong or the account does not exist. AN1521 defines the behaviour as a *series* of failures over a TimeWindow with a SourceIPThreshold, and Sigma as this corpus constrains it models neither a count nor a window nor a join to the later success — which is why the parent T1110 is declined here outright. What one event can still carry is MITRE's `UsernamePattern` knob, populated below with generic and default account names rather than with anything MITRE supplied, so the rule sees one guess and leaves the burst to be recognised by whoever reads the alerts. Two clauses do the narrowing. `LogonType` is limited to 3 (network, so SMB and WinRM), 8 (network cleartext, so basic-auth web management) and 10 (RemoteInteractive, so RDP), which drops the console mistype that produces most benign 4625s. `SubStatus` is limited to 0xC000006A (bad password) and 0xC0000064 (no such user), which drops failures caused by lockout, a disabled or expired account and logon-hour restrictions — administrative outcomes, not guesses. If a collector normalises 4625 without preserving `SubStatus`, that clause must be removed or the rule matches nothing. The match is exact on `TargetUserName`, not a substring, so `admin1`, `administrator2` and localised names such as `administrateur` fall outside it; widening the list is the intended tuning direction. 4625 is written by the machine that performed the authentication, so guessing against a *domain* account is recorded on the domain controller as 4771/4768/4776 instead and is invisible here — this rule covers local accounts and the member-server and workstation leg only. It is written in the Security channel vocabulary (`EventID`, `LogonType`, `SubStatus`, `TargetUserName`) and none of those fields carry over to a Sysmon category. Unlike 4688, the audit subcategory behind 4625 (*Audit Logon*, Failure) is enabled in the default configuration and in the Microsoft and CIS baselines, so no extra policy is needed. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0551, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

SecurityEvent| where (EventID == 4625 and (LogonType == 3 or LogonType == 8 or LogonType == 10) and (SubStatus =~ "0xC000006A" or SubStatus =~ "0xC0000064") and (TargetUserName =~ "administrator" or TargetUserName =~ "admin" or TargetUserName =~ "guest" or TargetUserName =~ "root" or TargetUserName =~ "sa" or TargetUserName =~ "sysadmin" or TargetUserName =~ "oracle" or TargetUserName =~ "postgres" or TargetUserName =~ "ftp" or TargetUserName =~ "test" or TargetUserName =~ "user" or TargetUserName =~ "backup" or TargetUserName =~ "support" or TargetUserName =~ "demo"))

Splunk · SPL

Run this as a search.

index=* (EventID="4625" AND (LogonType="3" OR LogonType="8" OR LogonType="10") AND (SubStatus="0xC000006A" OR SubStatus="0xC0000064") AND (TargetUserName="administrator" OR TargetUserName="admin" OR TargetUserName="guest" OR TargetUserName="root" OR TargetUserName="sa" OR TargetUserName="sysadmin" OR TargetUserName="oracle" OR TargetUserName="postgres" OR TargetUserName="ftp" OR TargetUserName="test" OR TargetUserName="user" OR TargetUserName="backup" OR TargetUserName="support" OR TargetUserName="demo"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (event.code == 4625 AND (LogonType == 3 OR LogonType == 8 OR LogonType == 10) AND (TO_LOWER(SubStatus) == "0xc000006a" OR TO_LOWER(SubStatus) == "0xc0000064") AND (TO_LOWER(TargetUserName) == "administrator" OR TO_LOWER(TargetUserName) == "admin" OR TO_LOWER(TargetUserName) == "guest" OR TO_LOWER(TargetUserName) == "root" OR TO_LOWER(TargetUserName) == "sa" OR TO_LOWER(TargetUserName) == "sysadmin" OR TO_LOWER(TargetUserName) == "oracle" OR TO_LOWER(TargetUserName) == "postgres" OR TO_LOWER(TargetUserName) == "ftp" OR TO_LOWER(TargetUserName) == "test" OR TO_LOWER(TargetUserName) == "user" OR TO_LOWER(TargetUserName) == "backup" OR TO_LOWER(TargetUserName) == "support" OR TO_LOWER(TargetUserName) == "demo"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4625$</field>    <field name="LogonType" type="pcre2">(?i)(^3$|^8$|^10$)</field>    <field name="SubStatus" type="pcre2">(?i)(^0xC000006A$|^0xC0000064$)</field>    <field name="TargetUserName" type="pcre2">(?i)(^administrator$|^admin$|^guest$|^root$|^sa$|^sysadmin$|^oracle$|^postgres$|^ftp$|^test$|^user$|^backup$|^support$|^demo$)</field>    <description>Detect failed remote logons against commonly guessed accounts</description>    <mitre>      <id>T1110.001</id>    </mitre>  </rule></group>

At a glance

Logsource: security / windows
Level: medium
Category: brute_force
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 96b89932-c9a8-4ec0-b741-5a9f25b00b09

ATT&CKT1110.001

T1110.001Password Guessing

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonbrute force

brute forceAI draft — unreviewed

01 · What this rule detects

One Windows Security EventID 4625 — a failed logon — where the account being tried is one of fourteen generic or default names, the attempt arrived over the network, and the failure reason was a wrong password or a non-existent account. MITRE's AN1521 describes the real observable as a series of failures against the same or similar accounts over a window from one or more remote IPs. Sigma as this corpus constrains it models no count, no window and no join to a later success, so the rule keeps the single-event shape and leaves the burst to whoever reads the alerts. That is why parent T1110 is declined outright here.

02 · Telemetry you need

The Windows Security channel from member servers and workstations — product: windows, service: security, copied verbatim from AN1521. Unlike 4688, the subcategory behind 4625 (Audit Logon, Failure) is on in a default install and in the Microsoft and CIS baselines, so no policy work is required. What matters is what your collector keeps: the events must arrive with SubStatus and LogonType intact. Also note 4625 is written by the machine that performed the authentication, so guessing against a domain account lands on the domain controller as 4771/4768/4776 and is invisible here.

03 · How the logic works

One selection with four ANDed clauses. EventID: 4625 picks the failure. LogonType is limited to 3 (network — SMB, WinRM), 8 (network cleartext — basic-auth management interfaces) and 10 (RemoteInteractive — RDP), which drops the console mistype behind most benign 4625s. SubStatus is limited to 0xC000006A (bad password) and 0xC0000064 (no such user), dropping lockouts, disabled or expired accounts and logon-hour denials — administrative outcomes, not guesses. TargetUserName is an exact match against administrator, admin, guest, root, sa, sysadmin, oracle, postgres, ftp, test, user, backup, support and demo. That list is MITRE's UsernamePattern knob populated with values authored here; MITRE supplied the knob, not the names. Exact matching means admin1 and administrateur fall outside it.

04 · Common false positives

Densest by a wide margin: a service, scheduled task or mapped drive still holding an old password for a local administrator, backup or support account, retrying on a timer from one fixed internal address. Then authenticated vulnerability scanners sweeping the estate with a credential set that is stale on some hosts. Then help desk engineers mistyping over RDP or WinRM, which writes exactly this event. And any estate that genuinely operates accounts called test, user or demo matches on every forgotten password.

05 · Detection maturity

tier_1: Lowest tier, and it stays there until someone runs it against real data. It was authored from MITRE prose, never extracted from a working detection and never executed against a log line. Rendering in four backends and using only fields real for 4625 are hygiene, not evidence it fires. Level medium sits at the ceiling of what its own false positives support; if the shipped name list goes out untrimmed, low is the honest level.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

The name list is also this rule's coverage boundary, which is the half that matters. Guessing against real accounts under your own naming convention — jsmith, svc_backup — produces zero matches however many thousand attempts it makes. Replace the generic list with local high-value names before deployment; that is a prerequisite, not a refinement. Next, allowlist the source addresses of the stale-credential retriers. Then check the two narrowing clauses against your own data: if 4625s arrive without SubStatus, or with LogonType absent or zeroed by normalisation, relax that clause deliberately rather than letting it silently match nothing. SubStatus is written uppercase per SigmaHQ convention while raw EVTX renders it lowercase, so case-sensitive Splunk or Elastic keyword mappings can parse the rule and still match nothing.

Declared by the author

A service, scheduled task or mapped drive still holding an old password for a local account named administrator, backup or support. It retries on a timer from one fixed internal address and is the densest recurring source of matches this rule will ever produce, so a source-address allowlist is the first tuning step rather than an optional one.
Authenticated vulnerability scanners and asset-inventory tools sweeping the estate with a credential set that is wrong or expired on a subset of hosts, which produces a burst of LogonType 3 failures against administrator from the scanner's address on every scan schedule.
A help desk engineer mistyping the local administrator password over RDP or WinRM, which writes exactly this event with LogonType 10 or 3 and is indistinguishable from a guess at the single-event level.
Estates that genuinely operate accounts called test, user, backup, support or demo, where every ordinary forgotten password for those users matches. Trim the name list to names that do not exist in your directory before deploying it.
Legacy line-of-business applications authenticating over LogonType 8 with a hard-coded generic account name that was missed in a password rotation, which then fails on every request until someone notices.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1110.001, evaluated against their — events.

Share this rule

/u/siemphony/96b89932-c9a8-4ec0-b741-5a9f25b00b09

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect failed remote logons against commonly guessed accounts

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it