Suspicious MSSQL Server Failed Logon From External Network (via application)

title: Suspicious MSSQL Server Failed Logon From External Network (via application)
id: 4313a661-ef76-5b5b-acf3-d236005ac99b
status: stable
description: This rule detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.
references:
    - https://attack.mitre.org/techniques/T1110/
    - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/
    - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html
author: Huntrule Team
date: 2026-05-31
tags:
    - attack.credential-access
    - attack.t1110
logsource:
    product: windows
    service: application
    definition: 'Requirements: Must enable MSSQL authentication.'
detection:
    selection:
        Provider_Name|contains: 'MSSQL'
        EventID: 18456
    filter_main_local_ips:
        Data|contains:
            - 'CLIENT: 10.'
            - 'CLIENT: 172.16.'
            - 'CLIENT: 172.17.'
            - 'CLIENT: 172.18.'
            - 'CLIENT: 172.19.'
            - 'CLIENT: 172.20.'
            - 'CLIENT: 172.21.'
            - 'CLIENT: 172.22.'
            - 'CLIENT: 172.23.'
            - 'CLIENT: 172.24.'
            - 'CLIENT: 172.25.'
            - 'CLIENT: 172.26.'
            - 'CLIENT: 172.27.'
            - 'CLIENT: 172.28.'
            - 'CLIENT: 172.29.'
            - 'CLIENT: 172.30.'
            - 'CLIENT: 172.31.'
            - 'CLIENT: 192.168.'
            - 'CLIENT: 127.'
            - 'CLIENT: 169.254.'
            - 'CLIENT: <local machine>'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium