SignalHunt
← All rules

WIN-1001

critical

Brute Force Logon Followed by Success

Detects a cluster of failed interactive/network logons (EventID 4625) against the same account from the same source, followed by a successful logon (EventID 4624) from that same source within the same window - i.e. a password spray or brute force attempt that succeeded.

T1110T1110.001

Detection logic

{
  "detection_type": "sequence",
  "groupby": "IpAddress",
  "timeframe_minutes": 10
}

Log source: product=windows, service=security · Event ID(s): 4625, 4624

Required log fields

  • TargetUserName
  • TargetSid
  • IpAddress
  • LogonType
  • WorkstationName

Enabling this in your environment

Where: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Logon/Logoff > Audit Logon (Success and Failure) 

auditpol /set /subcategory:"Logon" /success:enable /failure:enable

Enabled by default on modern Windows Server/clients, but confirm it hasn't been disabled via GPO. TargetSid is populated on 4624 but is S-1-0-0 (unresolved) on 4625, since Windows hasn't matched the credential to an account yet - group by TargetUserName + IpAddress, not TargetSid, to correlate the failed attempts.

False positives

  • A user who genuinely mistypes their password several times then succeeds
  • Shared NAT/proxy IP serving many legitimate users (group by workstation instead)

References