{"id":"f88e112a-21aa-44bd-9b01-6ee2a2bbbed1","title":"Failed Logon From Public IP","description":"Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.","author":"NVISO","status":"test","level":"medium","date":"2020-05-06","modified":"2024-03-11","tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.t1190","attack.t1133"],"technique_ids":["T1078","T1133","T1190"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Legitimate logon attempts over the internet","IPv4-to-IPv6 mapped IPs"],"references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625"],"source_path":"rules/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml","source_sha256":"2b340875ecf8432e60158f67cccb398068d61af24cc92ff9c341d73f2308b4f0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Failed Logon From Public IP\nid: f88e112a-21aa-44bd-9b01-6ee2a2bbbed1\nstatus: test\ndescription: Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.\nreferences:\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625\nauthor: NVISO\ndate: 2020-05-06\nmodified: 2024-03-11\ntags:\n    - attack.privilege-escalation\n    - attack.initial-access\n    - attack.persistence\n    - attack.stealth\n    - attack.t1078\n    - attack.t1190\n    - attack.t1133\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4625\n    filter_main_ip_unknown:\n        IpAddress|contains: '-'\n    filter_main_local_ranges:\n        IpAddress|cidr:\n            - '::1/128'  # IPv6 loopback\n            - '10.0.0.0/8'\n            - '127.0.0.0/8'\n            - '172.16.0.0/12'\n            - '192.168.0.0/16'\n            - '169.254.0.0/16'\n            - 'fc00::/7'  # IPv6 private addresses\n            - 'fe80::/10'  # IPv6 link-local addresses\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate logon attempts over the internet\n    - IPv4-to-IPv6 mapped IPs\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"},{"key":"enterprise/T1133","id":"T1133","name":"External Remote Services","page":"techniques/enterprise/T1133/"},{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"}],"data_path":"data/detection-rules/f88e112a-21aa-44bd-9b01-6ee2a2bbbed1.json","kind":"sigma"}