Metasploit SMB Authentication Attempts via NTLM (Windows Security 4624/4625, 4776)

Detects Metasploit-linked NTLM SMB authentication activity using Windows 4624/4625 and 4776 with 16-char workstation names.

FreeUnreviewedSigmahighv1

metasploit-smb-authentication-attempts-via-ntlm-windows-security-4624-4625-4776-72124974

title: Metasploit SMB Authentication Attempts via NTLM (Windows Security 4624/4625, 4776)
id: a1d3ad5a-81e4-42c3-bae5-be84bd8f7b3f
status: test
description: This rule flags Windows domain authentication activity associated with Metasploit using SMB-style logons and NTLM. Attackers often rely on NTLM-based SMB authentication for lateral movement and remote access, so correlating these events helps identify suspicious authentication behavior. It relies on Windows Security logs for failed and successful logons (4624/4625) and corresponding NTLM authentication events (4776) with workstation names matching a 16-character alphanumeric pattern.
references:
  - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/lib/rex/proto/smb/client.rb
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_metasploit_authentication.yml
author: Chakib Gzenayi (@Chak092), Hosni Mribah, Huntrule Team
date: 2020-05-06
modified: 2024-01-25
tags:
  - attack.lateral-movement
  - attack.t1021.002
logsource:
  product: windows
  service: security
detection:
  selection1:
    EventID:
      - 4625
      - 4624
    LogonType: 3
    AuthenticationPackageName: NTLM
    WorkstationName|re: ^[A-Za-z0-9]{16}$
  selection2:
    EventID: 4776
    Workstation|re: ^[A-Za-z0-9]{16}$
  condition: 1 of selection*
falsepositives:
  - Linux hostnames composed of 16 characters.
level: high
license: DRL-1.1
related:
  - id: 72124974-a68b-4366-b990-d30e0b2a190d
    type: derived

What it detects

This rule flags Windows domain authentication activity associated with Metasploit using SMB-style logons and NTLM. Attackers often rely on NTLM-based SMB authentication for lateral movement and remote access, so correlating these events helps identify suspicious authentication behavior. It relies on Windows Security logs for failed and successful logons (4624/4625) and corresponding NTLM authentication events (4776) with workstation names matching a 16-character alphanumeric pattern.

Known false positives

Linux hostnames composed of 16 characters.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.