{"id":"9eb99343-d336-4020-a3cd-67f3819e68ee","title":"Account Tampering - Suspicious Failed Logon Reasons","description":"This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-02-19","modified":"2025-10-17","tags":["attack.persistence","attack.privilege-escalation","attack.initial-access","attack.stealth","attack.t1078"],"technique_ids":["T1078"],"logsource":{"product":"windows","service":"security"},"falsepositives":["User using a disabled account"],"references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625","https://twitter.com/SBousseaden/status/1101431884540710913"],"source_path":"rules/windows/builtin/security/win_security_susp_failed_logon_reasons.yml","source_sha256":"b5567dfa0e49d6119aa008844d3681228584b880f4249befa13b6e11a0dfaef4","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_failed_logon_reasons.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Account Tampering - Suspicious Failed Logon Reasons\nid: 9eb99343-d336-4020-a3cd-67f3819e68ee\nstatus: test\ndescription: This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.\nreferences:\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625\n    - https://twitter.com/SBousseaden/status/1101431884540710913\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-02-19\nmodified: 2025-10-17\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.initial-access\n    - attack.stealth\n    - attack.t1078\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection_eid:\n        EventID:\n            - 4625\n            - 4776\n    selection_status:\n        - Status:\n              - '0xC0000072'  # User logon to account disabled by administrator\n              - '0xC000006F'  # User logon outside authorized hours\n              - '0xC0000070'  # User logon from unauthorized workstation\n              - '0xC0000413'  # Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine\n              - '0xC000018C'  # The logon request failed because the trust relationship between the primary domain and the trusted domain failed\n              - '0xC000015B'  # The user has not been granted the requested logon type (aka logon right) at this machine\n        - SubStatus:\n              - '0xC0000072'  # User logon to account disabled by administrator\n              - '0xC000006F'  # User logon outside authorized hours\n              - '0xC0000070'  # User logon from unauthorized workstation\n              - '0xC0000413'  # Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine\n              - '0xC000018C'  # The logon request failed because the trust relationship between the primary domain and the trusted domain failed\n              - '0xC000015B'  # The user has not been granted the requested logon type (aka logon right) at this machine\n    filter:\n        SubjectUserSid: 'S-1-0-0'\n    condition: all of selection_* and not filter\nfalsepositives:\n    - User using a disabled account\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"}],"data_path":"data/detection-rules/9eb99343-d336-4020-a3cd-67f3819e68ee.json","kind":"sigma"}