NTLM Brute Force — Sigma Rule

Rule metadata and linked tags

Author: Jerry Shockley '@jsh0x'. Source status: test; severity: medium. Source dates: 2022-02-02 / not supplied.

{
  "product": "windows",
  "service": "ntlm",
  "definition": "Requires events from Microsoft-Windows-NTLM/Operational"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: bd2bfaa433093831880804c30c3772a07745ed427e71019deb94d5d0eb2513ea

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: NTLM Brute Force
id: 9c8acf1a-cbf9-4db6-b63c-74baabe03e59
status: test
description: Detects common NTLM brute force device names
references:
    - https://www.varonis.com/blog/investigate-ntlm-brute-force
author: Jerry Shockley '@jsh0x'
date: 2022-02-02
tags:
    - attack.credential-access
    - attack.t1110
logsource:
    product: windows
    service: ntlm
    definition: Requires events from Microsoft-Windows-NTLM/Operational
detection:
    selection:
        EventID: 8004
    devicename:
        WorkstationName:
            - 'Rdesktop'
            - 'Remmina'
            - 'Freerdp'
            - 'Windows7'
            - 'Windows8'
            - 'Windows2012'
            - 'Windows2016'
            - 'Windows2019'
    condition: selection and devicename
falsepositives:
    - Systems with names equal to the spoofed ones used by the brute force tools
level: medium

Original YAML and metadata in JSON

False positives

• Systems with names equal to the spoofed ones used by the brute force tools

Source references

• https://www.varonis.com/blog/investigate-ntlm-brute-force