{"id":"ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d","title":"MSSQL Server Failed Logon From External Network","description":"Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.","author":"j4son","status":"test","level":"medium","date":"2023-10-11","modified":"2025-05-28","tags":["attack.credential-access","attack.t1110"],"technique_ids":["T1110"],"logsource":{"product":"windows","service":"application","definition":"Requirements: Must enable MSSQL authentication."},"falsepositives":["Unknown"],"references":["https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/","https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html"],"source_path":"rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml","source_sha256":"430230b5f0e7837b57f7f1ce7085349c3f6a6542ca84d477cdf7dd829981de82","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: MSSQL Server Failed Logon From External Network\nid: ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d\nrelated:\n    - id: 218d2855-2bba-4f61-9c85-81d0ea63ac71\n      type: similar\nstatus: test\ndescription: Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.\nreferences:\n    - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/\n    - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html\nauthor: j4son\ndate: 2023-10-11\nmodified: 2025-05-28\ntags:\n    - attack.credential-access\n    - attack.t1110\nlogsource:\n    product: windows\n    service: application\n    definition: 'Requirements: Must enable MSSQL authentication.'\ndetection:\n    selection:\n        Provider_Name|contains: 'MSSQL' # Note: We use contains to account for other third party providers - See https://github.com/SigmaHQ/sigma/issues/4876\n        EventID: 18456\n    filter_main_local_ips:\n        Data|contains:\n            - 'CLIENT: 10.' # filter_range_IP: 10.0.0.0/8\n            - 'CLIENT: 172.16.' # filter_range_IP: 172.16.0.0/12\n            - 'CLIENT: 172.17.'\n            - 'CLIENT: 172.18.'\n            - 'CLIENT: 172.19.'\n            - 'CLIENT: 172.20.'\n            - 'CLIENT: 172.21.'\n            - 'CLIENT: 172.22.'\n            - 'CLIENT: 172.23.'\n            - 'CLIENT: 172.24.'\n            - 'CLIENT: 172.25.'\n            - 'CLIENT: 172.26.'\n            - 'CLIENT: 172.27.'\n            - 'CLIENT: 172.28.'\n            - 'CLIENT: 172.29.'\n            - 'CLIENT: 172.30.'\n            - 'CLIENT: 172.31.'\n            - 'CLIENT: 192.168.' # filter_range_IP: 192.168.0.0/16\n            - 'CLIENT: 127.' # filter_loop_back: 127.0.0.0/8\n            - 'CLIENT: 169.254.' # fileter_link-local_addressing: 169.254.0.0/16\n            - 'CLIENT: <local machine>'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","page":"techniques/enterprise/T1110/"}],"data_path":"data/detection-rules/ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d.json","kind":"sigma"}