{"id":"218d2855-2bba-4f61-9c85-81d0ea63ac71","title":"MSSQL Server Failed Logon","description":"Detects failed logon attempts from clients to MSSQL server.","author":"Nasreddine Bencherchali (Nextron Systems), j4son","status":"test","level":"low","date":"2023-10-11","modified":"2024-06-26","tags":["attack.credential-access","attack.t1110"],"technique_ids":["T1110"],"logsource":{"product":"windows","service":"application","definition":"Requirements: Must enable MSSQL authentication."},"falsepositives":["This event could stem from users changing an account's password that's used to authenticate via a job or an automated process. Investigate the source of such events and mitigate them"],"references":["https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/","https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html"],"source_path":"rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon.yml","source_sha256":"1998dae08584c37fb27aa431b688d1b6aeaa00f54500586ad55a50e86e2e6070","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: MSSQL Server Failed Logon\nid: 218d2855-2bba-4f61-9c85-81d0ea63ac71\nrelated:\n    - id: ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d\n      type: similar\nstatus: test\ndescription: Detects failed logon attempts from clients to MSSQL server.\nreferences:\n    - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/\n    - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html\nauthor: Nasreddine Bencherchali (Nextron Systems), j4son\ndate: 2023-10-11\nmodified: 2024-06-26\ntags:\n    - attack.credential-access\n    - attack.t1110\nlogsource:\n    product: windows\n    service: application\n    definition: 'Requirements: Must enable MSSQL authentication.'\ndetection:\n    selection:\n        Provider_Name|contains: 'MSSQL' # Note: We use contains to account for other third party providers - See https://github.com/SigmaHQ/sigma/issues/4876\n        EventID: 18456\n    condition: selection\nfalsepositives:\n    - This event could stem from users changing an account's password that's used to authenticate via a job or an automated process. Investigate the source of such events and mitigate them\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","page":"techniques/enterprise/T1110/"}],"data_path":"data/detection-rules/218d2855-2bba-4f61-9c85-81d0ea63ac71.json","kind":"sigma"}