Detectionmediumtest
NTLM Brute Force
Detects common NTLM brute force device names
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
Windowsntlm
ProductWindows← raw: windows
Servicentlm← raw: ntlm
Definition
Requires events from Microsoft-Windows-NTLM/Operational
Detection Logic
Detection Logic2 selectors
detection:
selection:
EventID: 8004
devicename:
WorkstationName:
- 'Rdesktop'
- 'Remmina'
- 'Freerdp'
- 'Windows7'
- 'Windows8'
- 'Windows2012'
- 'Windows2016'
- 'Windows2019'
condition: selection and devicenameFalse Positives
Systems with names equal to the spoofed ones used by the brute force tools
References
MITRE ATT&CK
Tactics
Techniques
Rule Metadata
Rule ID
9c8acf1a-cbf9-4db6-b63c-74baabe03e59
Status
test
Level
medium
Type
Detection
Created
Wed Feb 02
Author
Path
rules/windows/builtin/ntlm/win_susp_ntlm_brute_force.yml
Raw Tags
attack.credential-accessattack.t1110