Account Manipulation - Suspicious Failed Logon Reasons (via security)

title: Account Manipulation - Suspicious Failed Logon Reasons (via security)
id: d139cab1-df3b-5af6-9b71-4a364e5c70d0
status: stable
description: This rule detects this method uses uncommon error codes on failed logons to determine anomalous behavior and tampering with accounts that have been disabled or somehow restricted.
references:
    - https://attack.mitre.org/techniques/T1078/
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
    - https://twitter.com/SBousseaden/status/1101431884540710913
author: Huntrule Team
date: 2026-04-05
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.initial-access
    - attack.stealth
    - attack.t1078
logsource:
    product: windows
    service: security
detection:
    selection_eid:
        EventID:
            - 4625
            - 4776
    selection_status:
        - Status:
              - '0xC0000072'
              - '0xC000006F'
              - '0xC0000070'
              - '0xC0000413'
              - '0xC000018C'
              - '0xC000015B'
        - SubStatus:
              - '0xC0000072'
              - '0xC000006F'
              - '0xC0000070'
              - '0xC0000413'
              - '0xC000018C'
              - '0xC000015B'
    filter:
        SubjectUserSid: 'S-1-0-0'
    condition: all of selection_* and not filter
falsepositives:
    - Unknown
level: medium