Multiple Logon Failures from Single Source Indicate Brute Force Attempt

This detection identifies potential brute force attacks against Windows systems. The rule triggers when a high number of failed logon attempts originate from the same source IP address within a short timeframe (60 seconds), targeting multiple user accounts. This activity is indicative of attackers attempting to gain unauthorized access by guessing credentials. The rule excludes common benign failure codes related to misconfiguration issues (0xC000015b, 0xC000005e, 0xC0000133, 0xC0000192, 0xc00000dc) to reduce false positives. Successful detection of this activity enables defenders to identify and respond to potential credential compromise attempts early in the attack lifecycle.

Attack Chain

1. The attacker initiates a network connection to a Windows system, typically over SMB or RDP.
2. The attacker attempts to authenticate using a list of usernames and passwords.
3. The Windows system logs a failed logon event (Event ID 4625) for each unsuccessful attempt. The event includes the source IP address, target username, and failure reason.
4. The attacker iterates through different username/password combinations, generating multiple failed logon events from the same source IP.
5. The system aggregates these failed logon events within a 60-second window.
6. If the number of failed attempts exceeds a defined threshold (100 in this case) and targets at least 2 distinct users, an alert is triggered.
7. If successful, the attacker gains access to a user account.
8. The attacker may then attempt lateral movement or privilege escalation.

Impact

Successful brute force attacks can lead to unauthorized access to sensitive data, system compromise, and potential lateral movement within the network. Depending on the compromised accounts' privileges, the attacker could gain complete control over the targeted system or even the entire domain. While the specific number of victims is unknown, such attacks can affect any organization using vulnerable Windows systems without proper account lockout policies and monitoring.

Recommendation

• Deploy the Sigma rule "Multiple Logon Failure from the same Source Address" to your SIEM and tune the threshold for your environment.
• Investigate any alerts generated by the Sigma rule "Multiple Logon Failure from the same Source Address", prioritizing attempts against privileged accounts.
• Enable Windows Security Event Logging to collect the necessary data for the provided Sigma rule.
• Review and enforce strong password policies and account lockout thresholds to mitigate brute force attacks.
• Consider implementing multi-factor authentication (MFA) to further protect against credential compromise.