Suspicious NTLM Brute Force (via ntlm)

title: Suspicious NTLM Brute Force (via ntlm)
id: a7c8d1d3-0f18-53e6-8daf-bc8941137b12
status: stable
description: This rule detects common NTLM brute force device names
references:
    - https://attack.mitre.org/techniques/T1110/
    - https://www.varonis.com/blog/investigate-ntlm-brute-force
author: Huntrule Team
date: 2026-06-16
tags:
    - attack.credential-access
    - attack.t1110
logsource:
    product: windows
    service: ntlm
    definition: Requires events from Microsoft-Windows-NTLM/Operational
detection:
    selection:
        EventID: 8004
    devicename:
        WorkstationName:
            - 'Rdesktop'
            - 'Remmina'
            - 'Freerdp'
            - 'Windows7'
            - 'Windows8'
            - 'Windows2012'
            - 'Windows2016'
            - 'Windows2019'
    condition: selection and devicename
falsepositives:
    - Unknown
level: medium